{"id":"CVE-2026-118599","kind":"vulnerability","aliases":["CVE-2026-118599"],"related":[],"title":"GNOME Epiphany: crafted .xpi extension file overwrites a user's writable files","description":"A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files.\n\nIn src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi.\n\nThis is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143).\n\nRequirements: the victim must install or open a malicious WebExtension (.xpi).\n\nAffected: Epiphany >= 47.0 (WebExtension XPI install path).\nFixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support).\nUpstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988\nReporter acknowledgment: Fernando Munoz","summary":"Epiphany's WebExtension installer accepted tar archives named .xpi and followed hard-link entries, so a crafted extension can truncate and overwrite an existing user-writable file with attacker content. The victim must install or open the malicious .xpi file.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["epiphany","gnome","linux-desktop","package"],"not_affected_if":["default-config","no-untrusted-xpi"],"how_to_check":"- Check the Epiphany version with `epiphany --version`; versions 47.0 and later are in the affected range.\n- Look for installed WebExtensions from untrusted sources in the Epiphany extensions directory.","fix":"- Epiphany fixed by enabling only ZIP format support in merge request 2248 (commit 0cc9ab55); the sources do not name a fixed release version.","status":"open","published_at":"2026-10-31T10:16:38+00:00","first_seen_at":"2026-10-31T10:34:56+00:00","triaged_at":"2026-10-31T10:36:02+00:00","updated_at":"2026-10-31T10:36:02+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T10:36:02Z","model":"claude-haiku-5-5","output":{"fix":"- Epiphany fixed by enabling only ZIP format support in merge request 2248 (commit 0cc9ab55); the sources do not name a fixed release version.","reach":"local","title":"GNOME Epiphany: crafted .xpi extension file overwrites a user's writable files","impact":"medium","summary":"Epiphany's WebExtension installer accepted tar archives named .xpi and followed hard-link entries, so a crafted extension can truncate and overwrite an existing user-writable file with attacker content. The victim must install or open the malicious .xpi file.","audience":"everyone","category":"package","nicknames":[],"who_cares":["epiphany","gnome","linux-desktop"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"existing user-writable files are overwritten with attacker content","analyst_note":"","how_to_check":"- Check the Epiphany version with `epiphany --version`; versions 47.0 and later are in the affected range.\n- Look for installed WebExtensions from untrusted sources in the Epiphany extensions directory.","plain_action":"Update Epiphany (the GNOME web browser) to a release that includes the fix, and only install browser extensions from sources you trust.","needs_analyst":false,"not_affected_if":["default-config","no-untrusted-xpi"],"who_is_affected":"Users of GNOME Epiphany 47.0 and later who install or open a WebExtension .xpi file from an untrusted source. The flaw is in the local install path, so exposure depends on the user opening a crafted file; systems that never install extensions from files are not exposed.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000745,"input_tokens":4498,"output_tokens":590,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118599':15A,18A '-2026':14A,17A,190C '-77679':191C '/gnome/epiphany/-/merge_requests/2248':216C '/gnome/epiphany/-/work_items/2988':227C '0cc9ab55':218C '2143':194C '2922':192C '47.0':208C 'accept':29B 'acknowledg':229C 'affect':206C 'archiv':31B,89C,122C,127C 'attack':55B,140C,154C 'attacker-chosen':139C 'attacker-control':153C 'bit':159C 'caus':137C 'chosen':141C 'commit':217C 'content':56B,156C 'control':155C 'craft':3A,42B,131C,172C 'cve':13A,16A,189C 'decompress':83C 'dedic':162C 'desktop':23B 'dialog':164C 'disk':124C 'enabl':220C 'entri':39B,117C 'epiphani':2A,19B,25B,73C,120C,207C 'exist':49B,71C,142C 'extens':5A,43B 'extract':111C,128C 'fernando':230C 'file':6A,12A,53B,66B,68C,80C,107C,146C 'filter':95C 'fix':187C,213C 'follow':35B 'format':92C,222C 'gitlab.gnome.org':215C,226C 'gitlab.gnome.org/gnome/epiphany/-/merge_requests/2248':214C 'gitlab.gnome.org/gnome/epiphany/-/work_items/2988':225C 'gnome':1A,20B 'hard':37B,115C,133C 'hard-link':36B,114C,132C 'includ':126C 'instal':28B,60B,75C,98C,168C,199C,211C 'libarch':87C 'link':38B,116C,134C 'linux':22B 'linux-desktop':21B 'malici':64B,203C 'mode':158C 'mr':193C 'munoz':231C 'must':59B,198C 'name':32B,108C 'open':62B,170C,201C 'option':125C 'overwrit':7A,47B,69C 'overwritten':151C 'packag':24B,77C 'path':185C,212C 'perm':129C 'read':90C 'real':103C 'relat':176C 'report':228C 'requir':101C,195C 'separ':179C 'slip':184C 'src/webextension/ephy-web-extension-manager.c':82C 'support':91C,113C,223C 'tar':30B,106C,112C 'target':135C 'thread':85C 'travers':186C 'truncat':45B,149C 'type':118C 'upstream':224C 'use':86C 'user':9A,51B,144C,167C 'user-writ':50B,143C 'victim':58B,197C 'vulner':70C 'warn':163C 'webextens':27B,76C,204C,209C 'without':160C 'writabl':11A,52B,145C 'write':123C 'xpi':4A,33B,65B,79C,84C,109C,173C,205C,210C 'zip':104C,183C,221C 'zip-slip':182C","nicknames":[],"mitigations":[],"who_affected":"Users of GNOME Epiphany 47.0 and later who install or open a WebExtension .xpi file from an untrusted source. The flaw is in the local install path, so exposure depends on the user opening a crafted file; systems that never install extensions from files are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Epiphany (the GNOME web browser) to a release that includes the fix, and only install browser extensions from sources you trust.","first_public_at":"2026-10-31T10:16:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","cvss_by":"patrick@puiterwijk.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118599","severity":null,"published_at":"2026-10-31T10:16:38+00:00","modified_at":"2026-10-31T10:16:38+00:00","first_seen_at":"2026-10-31T10:34:56+00:00","fetched_at":"2026-10-31T10:34:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}