CVE-2026-118599
Received Received - Intake

File Overwrite in Epiphany via Malicious XPI

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Fedora Project

Description
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi. This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143). Requirements: the victim must install or open a malicious WebExtension (.xpi). Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-118599
EUVD
EUVD-2026-114699

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
GNOME Epiphany 47.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-118599 is a file overwrite vulnerability in Epiphany (GNOME Web) affecting versions 47.0 and later. It occurs when installing WebExtension packages from .xpi files, which are typically ZIP archives but can be disguised as TAR files. Due to improper handling of hard links in TAR files by libarchive, a crafted .xpi file can overwrite existing user-writable files with attacker-controlled content during extraction without a warning dialog.

Detection Guidance

Check for suspicious .xpi files in user directories or temporary folders. Inspect installed extensions in Epiphany for unrecognized or recently added packages. Review system files for unexpected modifications, especially in user-writable locations like ~/.local/share or ~/.config.

Impact Analysis

This vulnerability can allow an attacker to overwrite important files on your system, such as shell startup scripts, desktop entries, or SSH authorized_keys. This could lead to arbitrary code execution, privilege escalation, or persistent access to your system. The impact depends on which files are overwritten and the attacker's goals.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized file overwrites on a user's system. If attacker-controlled content overwrites sensitive files like configuration or startup scripts, it may lead to unauthorized data access, modification, or execution, violating integrity and confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade Epiphany to a patched version. Avoid installing extensions from untrusted sources. Disable unused extensions. Inspect files in user directories for unauthorized changes after installing any .xpi file.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118599. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart