CVE-2026-118599

Name of the Vulnerable Software and Affected Versions Epiphany versions 47.0 and later

Description A file overwrite issue occurs during the installation of WebExtension packages from .xpi files. In the decompress xpi thread() function within src/webextension/ephy-web-extension-manager.c, the use of libarchive with archive read support format all() allows the extraction of TAR files renamed as .xpi. Because TAR supports hard-link entry types and the software uses specific archive write disk options, a specially crafted hard-link target can cause an existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits. This happens without a warning dialog when a user installs or opens a malicious .xpi file.

Recommendations Update Epiphany to a version that restricts archive support to the ZIP format only.