UBUNTU-CVE-2026-118599
Dashboard / Vulnerabilities / UBUNTU-CVE-2026-118599
Summary:
Details: A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi. This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143). Requirements: the victim must install or open a malicious WebExtension (.xpi). Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz
References: https://ubuntu.com/security/CVE-2026-118599, https://www.cve.org/CVERecord?id=CVE-2026-118599, https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988, https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248, https://access.redhat.com/security/cve/CVE-2026-118599, https://bugzilla.redhat.com/show_bug.cgi?id=2562969
Affected packages
Package
Name: epiphany-browser
Purl: pkg:deb/ubuntu/epiphany-browser?arch=source&distro=xenial
Affected ranges
Type: ECOSYSTEM
Events:
