File Overwrite Vulnerability in Epiphany Web Browser by GNOME
CVE-2026-118599

5.5MEDIUM

Key Information:

Vendor

Gnome
Status
Epiphany
Vendor
CVE Published:
31 October 2026

What is CVE-2026-118599?

A file overwrite vulnerability in the Epiphany web browser arises when users install or open malicious WebExtension packages from .xpi files. This flaw allows an attacker to specify a hard-link target that can overwrite existing files with arbitrary content. The issue stems from the way the Epiphany browser utilizes libarchive to decompress XPI files, specifically using functions that support TAR file formats without adequate safeguards. As a result, an attacker can exploit this vulnerability by crafting a .xpi file that triggers a file truncation, potentially leading to unauthorized data manipulation without any warning dialogs for the user. Users of Epiphany version 47.0 and above should be vigilant when installing WebExtensions from untrusted sources.

Affected Version(s)

Epiphany 47.0

References

https://access.redhat.com/security/cve/CVE-2026-118599
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2562969
issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Fernando Munoz for reporting this issue.
.