Vulnerability · Published Oct 31, 2026 · Assigned by fedora
CVE-2026-118599epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install
Medium 5.5
In plain English
A medium-severity security flaw in Epiphany from GNOME. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi. This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143). Requirements: the victim must install or open a malicious WebExtension (.xpi). Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | epiphany-browser | no fix listed | DEBIAN-CVE-2026-118599 |
| Debian:13 | epiphany-browser | no fix listed | DEBIAN-CVE-2026-118599 |
| Debian:14 | epiphany-browser | 51.2-1 | DEBIAN-CVE-2026-118599 |
| Ubuntu:22.04:LTS | epiphany-browser | no fix listed | UBUNTU-CVE-2026-118599 |
| Ubuntu:24.04:LTS | epiphany-browser | no fix listed | UBUNTU-CVE-2026-118599 |
| Ubuntu:26.04:LTS | epiphany-browser | no fix listed | UBUNTU-CVE-2026-118599 |
| Ubuntu:26.10 | epiphany-browser | no fix listed | UBUNTU-CVE-2026-118599 |
Affected products (as reported)
Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References
- https://access.redhat.com/security/cve/CVE-2026-118599 vdb-entry, x_refsource_REDHAT
- RHBZ#2562969 issue-tracking, x_refsource_REDHAT
- https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988
- https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248