# CVE-2026-118599: Epiphany file overwrite in WebExtension installer

Source: https://junglewise.ai/threats/cve-2026-118599-a-file-overwrite-vulnerability-exists-in-epiphany-when  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-31. Updated: 2026-10-31  
License: CC BY 4.0 with a link back

CVE-2026-118599 · Severity: medium · CVSS 5.5 · Published 2026-10-31

Epiphany is a web browser that supports extensions via WebExtension packages. A vulnerability in how it unpacks .xpi extension files allows an attacker to craft a malicious extension that, when installed by a user, overwrites arbitrary user-writable files with attacker-controlled content. This could lead to account compromise or installation of malware if a user installs a malicious extension.

Technologies: [Gnome Epiphany](https://junglewise.ai/threats/technologies/epiphany). Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome).

## Quick answers

**Is CVE-2026-118599 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118599 being exploited in the wild.

**How severe is CVE-2026-118599?** Medium severity, with a CVSS score of 5.5, published 31 October 2026.

**Which products and versions are affected?** Gnome Epiphany 47.0 and later.

**Is there a fix for CVE-2026-118599?** Yes: fixed in Versions containing MR !2248 / commit 0cc9ab55 (ZIP-only format support enabled). Until then: Do not install WebExtensions (.xpi files) from untrusted sources. Keep WebExtensions disabled when unused. After attempting to install any untrusted .xpi, inspect critical user files (shell startup files, autostart desktop entries, SSH authorized_keys) for unexpected modifications. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118599 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-118599?** Check whether you run Gnome Epiphany at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Versions containing MR !2248 / commit 0cc9ab55 (ZIP-only format support enabled)

Do not install WebExtensions (.xpi files) from untrusted sources. Keep WebExtensions disabled when unused. After attempting to install any untrusted .xpi, inspect critical user files (shell startup files, autostart desktop entries, SSH authorized_keys) for unexpected modifications.

## Technical details

The decompress_xpi_thread() function in ephy-web-extension-manager.c uses libarchive's archive_read_support_format_all(), which accepts TAR archives in addition to ZIP files. An attacker can craft a TAR file with a .xpi extension containing hard-link entries that, when extracted with ARCHIVE_EXTRACT_PERM enabled, overwrite existing user-writable files with attacker content. The attack requires user interaction to install or open the malicious .xpi file.

## Affected products

- GNOME Epiphany 47.0 and later

## Timeline

- 2026-10-31: disclosed

## References

- [https://gitlab.gnome.org/GNOME/epiphany](https://gitlab.gnome.org/GNOME/epiphany)
- [https://access.redhat.com/security/cve/CVE-2026-118599](https://access.redhat.com/security/cve/CVE-2026-118599)

## Related threats

- [GNOME Epiphany logic error in site permission handling](https://junglewise.ai/threats/cve-2026-118598-a-logic-error-in-epiphany-s-site-permission-handling-can-cause)
- [GNOME Epiphany TLS certificate warning bypass via race condition](https://junglewise.ai/threats/cve-2026-115683-a-race-condition-in-epiphany-allows-a-malicious-website-to)