Update CHANGELOG

added JS injection fix