GNOME Epiphany Browser WebExtension Installation Arbitrary File Overwrite Vulnerability (CVE-2026-118599)
Executive & SecOps Summary
SECOPS ASSESSMENTGNOME Epiphany browser versions 47.0 and above
Installing or opening a crafted WebExtension (.xpi) can cause user-writable files to be truncated and overwritten with attacker-controlled content and permissions without warning
Immediately upgrade Epiphany to the patched version that restricts archive extraction to the ZIP format only
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official upstream patch (commit 0cc9ab55), which restricts the extraction process to only support the ZIP format.
# For Debian/Ubuntu-based systems
sudo apt-get update
sudo apt-get install --only-upgrade epiphany-browser
# For Fedora/RHEL-based systems
sudo dnf upgrade epiphany2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict users from installing unapproved WebExtensions. You can temporarily revoke write permissions on the local extension directory to prevent installation.
# Temporarily restrict write access to the Epiphany web-extensions directory
chmod 500 ~/.local/share/epiphany/web-extensions 2>/dev/null || true3. Log Audit & IoC Verification Commands
Use the following commands to check the installed Epiphany version and scan for suspicious .xpi files that are actually TAR archives instead of ZIP files.
# Check the installed Epiphany version
epiphany --version
# Scan the Downloads directory for TAR-formatted files disguised as .xpi
find ~/Downloads -name '*.xpi' -exec sh -c 'file "$1" | grep -q "tar archive" && echo "[WARNING] Suspicious TAR-based XPI file detected: $1"' _ {} \;Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
A file overwrite vulnerability exists in the GNOME Epiphany browser during the installation of WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, the decompress_xpi_thread() function utilized libarchive with archive_read_support_format_all(). Because of this configuration, the installer did not enforce a strict ZIP format check, allowing TAR archives disguised with a .xpi extension to be processed.
2. Exploitation Mechanics & Attack Scenario
Since the TAR format natively supports hard-link entry types, and Epiphany's archive_write_disk options include ARCHIVE_EXTRACT_PERM, a security gap is introduced. An attacker can craft a malicious TAR archive renamed as an .xpi file containing a hard-link target. When a victim installs or opens this crafted .xpi file, an existing user-writable file chosen by the attacker is truncated and overwritten with attacker-controlled content and mode bits, bypassing any dedicated warning dialogs.
3. Infrastructure & Business Impact
Although this vulnerability requires user interaction (installing or opening a malicious extension), it poses a significant threat to endpoint security. An attacker could overwrite critical user configuration files (such as .bashrc or SSH authorized keys) within the user's home directory, potentially leading to local privilege escalation or remote code execution (RCE) under the context of the compromised user account.
Official Vendor Advisories & References
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi. This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143). Requirements: the victim must install or open a malicious WebExtension (.xpi). Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz
Frequently Asked SecOps Questions (CVE-2026-118599)
FAQQ1. How critical is CVE-2026-118599 and is it actively exploited in the wild?
CVE-2026-118599 is rated CVSS 5.5 (MEDIUM) with a 30-day EPSS exploitation probability of 0.2%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-118599?
Primary impacted vendors include gnome across epiphany. Scope summary: Epiphany versions 47.0 and above (WebExtension XPI installation path)
Q3. What temporary mitigations or workarounds exist for CVE-2026-118599 before patching?
[Mitigation] Immediately upgrade Epiphany to the patched version that restricts archive extraction to the ZIP format only Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-118599
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (gnome)
View Category →GNOME Epiphany Browser Permission Bypass and Unauthorized Camera/Microphone Access Vulnerability (CVE-2026-118598)
[Affected Scope] GNOME Epiphany browser versions 45.0 through at least 51.x
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Microsoft Defender Local Privilege Escalation Vulnerability (CVE-2026-41091) Technical Advisory
[Affected Scope] Windows operating system environments with Microsoft Defender enabled
GNOME json-glib Infinite Loop Denial of Service Vulnerability (CVE-2026-120194) Technical Advisory
[Affected Scope] Applications and systems utilizing the GNOME json-glib library to evaluate user-controlled JSONPath queries via json_path_query()
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.