CVE-2026-118599 Details
Description
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi. This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143). Requirements: the victim must install or open a malicious WebExtension (.xpi). Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz
A file overwrite vulnerability has been identified in Epiphany versions 47.0 and later. This issue arises when WebExtension packages are installed from .xpi files. The vulnerability is rooted in the way Epiphany's WebExtension manager handles file extraction. The function 'decompress_xpi_thread()' utilizes libarchive to read all archive formats, allowing TAR files masquerading as .xpi files to be extracted. TAR files can include hard-link entries, which, when exploited, can overwrite existing user-writable files with attacker-controlled content and permissions. This file modification occurs without any warning, as soon as the user opens the .xpi file. The vulnerability requires the user to manually install or open a malicious WebExtension package.
Users are advised to upgrade to the latest version of Epiphany that includes the patch for this vulnerability. When the WebExtensions feature is not in use, it is recommended to keep it disabled. After attempting to install an untrusted .xpi file, check for any unexpected changes to user files, such as shell startup files or SSH authorized_keys.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 31, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-118599 | [email protected] | AdvisoryRemedyVendor |
| https://bugzilla.redhat.com/show_bug.cgi?id=2562969 | [email protected] | Issue TrackingPermission RequiredVendor |
| https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 | [email protected] | Source CodeVendor |
| https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Epiphany | >= 47.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 31, 2026 | New CVE Received | [email protected] |