CVE-2026-118599 in Epiphany
Summary
by MITRE • 10/31/2026
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files.
In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi.
This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143).
Requirements: the victim must install or open a malicious WebExtension (.xpi).
Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
Epiphany, the default web browser for GNOME-based Linux distributions, contains a critical file overwrite vulnerability within its WebExtension installation mechanism. This flaw arises from an overly permissive configuration of the libarchive library used to process extension packages distributed in .xpi format. While these files are nominally ZIP archives, the underlying decompression function utilizes archive_read_support_format_all(), which allows the parser to accept and extract TAR archives disguised as XPI files. This lack of strict format validation creates a significant attack surface for attackers seeking to manipulate file system operations through crafted input data rather than exploiting traditional path traversal techniques associated with standard ZIP handling errors.
The core technical flaw lies in how Epiphany handles hard-link entries within these extracted archives when writing them to the disk. The installation process employs archive_write_disk options that include ARCHIVE_EXTRACT_PERM, which preserves or applies specific permission bits from the archive metadata during extraction. When a malicious .xpi file contains a TAR entry defined as a hard link pointing to an arbitrary existing user-writable path on the victim's system, the extraction logic does not merely create a new file but modifies the target of that hard link. Consequently, this action effectively truncates and overwrites the targeted file with content controlled by the attacker, while simultaneously applying potentially dangerous mode bits derived from the archive metadata. This behavior occurs without any dedicated warning dialog or explicit user consent beyond the initial installation click, bypassing standard security expectations for privilege escalation or data integrity protection mechanisms.
The operational impact of this vulnerability is severe, as it allows an attacker to achieve arbitrary file write privileges on the local system provided they can trick a victim into installing a malicious WebExtension package. By targeting sensitive configuration files, user documents, or executable scripts located in writable directories such as home folders or temporary storage areas, an adversary could compromise data integrity, inject malicious code for subsequent execution, or disrupt critical application states. This capability effectively transforms the browser extension installation process from a sandboxed feature into a vector for local file system manipulation and potential remote code execution if combined with other vulnerabilities or specific user configurations that allow script interpretation of overwritten files.
This issue is distinct from but related to CVE-2026-77679, which addressed ZIP-slip path traversal vulnerabilities where archive entries could escape the intended installation directory via relative paths like ../. While CVE-2026-77679 focused on preventing extraction outside of designated folders through strict path validation, this vulnerability exploits the semantic differences between TAR and ZIP formats to abuse hard-link functionality within a valid extraction context. The distinction highlights that even when files are extracted into correct directories, the internal structure of non-ZIP archives can still be leveraged for destructive file system operations if the underlying library is not constrained appropriately.
Mitigation strategies primarily involve enforcing strict format validation at the point of entry. As indicated by upstream fixes in merge request 2248 and commit 0cc9ab55, the recommended remediation is to restrict archive_read_support_format_all() to only enable ZIP format support for XPI files. By explicitly excluding TAR parsing capabilities during the installation phase, Epiphany ensures that any attempt to use a crafted TAR file disguised as an XPI will fail at the decompression stage rather than reaching the disk writing logic. Users should ensure their systems are updated with patches addressing this specific issue in versions 47.0 and later. Additionally, security awareness training emphasizing caution when installing browser extensions from untrusted sources remains a vital secondary defense layer against such social engineering-driven attacks.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory in the context of archive handling, though it specifically leverages hard-link abuse which relates closely to CWE-367: Time-of-check Time-of-use (TOCTOU) race conditions or more accurately CWE-409: Mishandled File Alias. In terms of adversary tactics, this technique corresponds to ATT&CK T1552.004 Unsecured Credentials via Local Credential Dumping if used for stealing data, but more directly maps to T1036 Masquerading and T1078 Valid Accounts through the abuse of trusted application behaviors. The exploitation requires user interaction, specifically the installation or opening of a malicious package, which places it within the Initial Access or Persistence phases depending on how the overwritten file is subsequently utilized by the attacker.