I just pushed a security update for expat. See: https://lwn.net/Articles/681356/
I recommend that you update ASAP. Note that Icecat includes a bundled copy of expat, so I guess it is probably still vulnerable. I hope to update it some time in the next few hours. For now, you might want to use Epiphany. Also note that this introduces grafts back into master, unfortunately. It might be that releasing 0.9.1 without grafts is too much to hope for. Mark