CVE-2026-118599
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. decompress_xpi_thread() used libarchive with archive_read_support_format_all(), allowing a TAR file named *.xpi to be extracted; a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a warning dialog, when the user installs or opens the crafted .xpi.
Risk Assessment
An attacker can trick a user into installing a malicious extension, leading to overwriting of any user-writable file, potentially enabling code execution or data corruption. This requires user interaction.
Recommendation
Update Epiphany to a version containing the fix (commit 0cc9ab55). Avoid installing extensions from untrusted sources.
Other vulnerabilities in Epiphany
See all- CVE-2026-118598Medium
A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In set_permission(), types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored, so control fell into an else-if branch that always set EPHY_PERMISSION_PERMIT for ACCESS_WEBCAM and ACCESS_MICROPHONE. A malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt.
- CVE-2026-115683Medium
A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. The 'tlsErrorPage' script message handler is registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin can call postMessage and approve a certificate exception without user interaction.
- CVE-2026-18487Medium
A flaw was found in Epiphany in how the browser reads web addresses, allowing attackers to fake the domain name shown in the address bar. Clicking a specially crafted link containing a colon (e.g., https://trusted.com:[email protected]/) displays the safe website (trusted.com) in the address bar but actually loads the attacker's website (attacker.com). This allows creating convincing phishing pages.
Original NVD description (English source)
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi. This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143). Requirements: the victim must install or open a malicious WebExtension (.xpi). Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz
Vulnerability data from NVD (NIST) · CISA KEV · EPSS