CVE-2026-118599mediumCWE-59

CVE-2026-118599: medium-severity vulnerability in GNOME Epiphany

epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install

Published · Updated

Follow this CVE+ Monitor Epiphany+ Monitor epiphany-browser

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.5epss 0.2%
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi. This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143). Requirements: the victim must install or open a malicious WebExtension (.xpi). Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected products
GNOME · Epiphany
Related CVEs — GNOME Epiphany

In the same product, most dangerous first.

CVE-2026-118598MEDIUMepiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone accessEPSS 0.5%CVE-2026-18487MEDIUMEpiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()EPSS 0.3%CVE-2026-115683MEDIUMepiphany: TLS certificate warning bypass via race in tlsErrorPage message handlerEPSS 0.2%