---
id: "CVE-2026-118599"
kind: "vulnerability"
aliases: ["CVE-2026-118599"]
title: "GNOME Epiphany: crafted .xpi extension file overwrites a user's writable files"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["epiphany", "gnome", "linux-desktop", "package"]
not_affected_if: ["default-config", "no-untrusted-xpi"]
published_at: "2026-10-31T10:16:38+00:00"
first_seen_at: "2026-10-31T10:34:56+00:00"
updated_at: "2026-10-31T10:36:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118599", "first_seen_at": "2026-10-31T10:34:56+00:00"}]
---

# GNOME Epiphany: crafted .xpi extension file overwrites a user's writable files

Epiphany's WebExtension installer accepted tar archives named .xpi and followed hard-link entries, so a crafted extension can truncate and overwrite an existing user-writable file with attacker content. The victim must install or open the malicious .xpi file.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Epiphany version with `epiphany --version`; versions 47.0 and later are in the affected range.
- Look for installed WebExtensions from untrusted sources in the Epiphany extensions directory.

## Fix

- Epiphany fixed by enabling only ZIP format support in merge request 2248 (commit 0cc9ab55); the sources do not name a fixed release version.

## Timeline

- 2026-10-31T10:34:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118599

## From the sources

A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files.

In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi.

This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143).

Requirements: the victim must install or open a malicious WebExtension (.xpi).

Affected: Epiphany >= 47.0 (WebExtension XPI install path).
Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support).
Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988
Reporter acknowledgment: Fernando Munoz

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_