Epiphany vulnerabilities

A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. decompress_xpi_thread() used libarchive with archive_read_support_format_all(), allowing a TAR file named *.xpi to be extracted; a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a warning dialog, when the user installs or opens the crafted .xpi.

A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In set_permission(), types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored, so control fell into an else-if branch that always set EPHY_PERMISSION_PERMIT for ACCESS_WEBCAM and ACCESS_MICROPHONE. A malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt.

A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. The 'tlsErrorPage' script message handler is registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin can call postMessage and approve a certificate exception without user interaction.

A flaw was found in Epiphany in how the browser reads web addresses, allowing attackers to fake the domain name shown in the address bar. Clicking a specially crafted link containing a colon (e.g., https://trusted.com:[email protected]/) displays the safe website (trusted.com) in the address bar but actually loads the attacker's website (attacker.com). This allows creating convincing phishing pages.