CVE-2026-118599

*** Pendiente de traducción *** A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files.<br /> <br /> In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany&amp;#39;s archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi.<br /> <br /> This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143).<br /> <br /> Requirements: the victim must install or open a malicious WebExtension (.xpi).<br /> <br /> Affected: Epiphany &gt;= 47.0 (WebExtension XPI install path).<br /> Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support).<br /> Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988<br /> Reporter acknowledgment: Fernando Munoz