Live › vulnerability › CVE-2026-118599
Epiphany's WebExtension installer accepted tar archives named .xpi and followed hard-link entries, so a crafted extension can truncate and overwrite an existing user-writable file with attacker content. The victim must install or open the malicious .xpi file.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 10:34 UTC. All times on this page are UTC.
Users of GNOME Epiphany 47.0 and later who install or open a WebExtension .xpi file from an untrusted source. The flaw is in the local install path, so exposure depends on the user opening a crafted file; systems that never install extensions from files are not exposed.
No product ranges from the sources yet.
epiphany --version; versions 47.0 and later are in the affected range.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files.
In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi.
This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143).
Requirements: the victim must install or open a malicious WebExtension (.xpi).
Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz
This page as .md · .json · in your agent: get_signal("CVE-2026-118599")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.