CVE-2026-118599: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-118599 is a file overwrite vulnerability in GNOME Epiphany (the GNOME web browser) affecting its WebExtension installation mechanism. When a user installs or opens a crafted .xpi file, a malicious TAR archive disguised as an .xpi can exploit hard-link entry types to truncate and overwrite existing user-writable files with attacker-controlled content and mode bits. The vulnerability affects Epiphany >= 47.0 (the WebExtension XPI install path). It is classified as HIGH severity by Feedly's estimate, and Red Hat rates it Moderate due to the required user interaction (Red Hat CVE). The CVE was inserted into Feedly's database on 2026-10-28 and the fix is tracked via GNOME GitLab MR !2248 (Red Hat CVE).

The root cause is CWE-59 (Improper Link Resolution Before File Access / 'Link Following'). In src/webextension/ephy-web-extension-manager.c, the function decompress_xpi_thread() uses libarchive with archive_read_support_format_all() and all filters, meaning it accepts any archive format — including TAR — not just ZIP. Because TAR supports hard-link entry types and Epiphany's extraction uses ARCHIVE_EXTRACT_PERM, a crafted hard-link target in the archive causes libarchive to truncate and overwrite an existing user-writable file (e.g., shell startup files, SSH authorized_keys, or autostart desktop entries) with attacker-controlled content and permissions, without any warning dialog (Red Hat CVE). This is related to but distinct from CVE-2026-77679, a ZIP-slip path traversal fixed in MR !2143. The fix (commit 0cc9ab55) restricts libarchive to ZIP format only (Red Hat CVE).

Successful exploitation allows an attacker to overwrite arbitrary user-writable files on the victim's system with attacker-controlled content and mode bits, resulting in a high integrity impact within the user's account. Sensitive targets include shell startup files (e.g., .bashrc, .profile), SSH authorized_keys, and autostart desktop entries, which could enable persistent code execution or privilege escalation within the user's session. Confidentiality and availability are not directly impacted, and exploitation is limited to the scope of the victim user's account — remote unauthenticated exploitation without user interaction is not possible (Red Hat CVE).

Exploitation requires the victim to manually install or open a malicious .xpi WebExtension package, which limits the attack surface. No in-the-wild exploitation has been reported, and no public proof-of-concept exploit code is listed in the available threat intelligence (Feedly, Red Hat CVE). The CVE status is currently "Reserved" and no EPSS score or CISA KEV catalog entry is available. A Tenable Nessus plugin (ID 373702) has been published to detect vulnerable Debian epiphany-browser installations (Tenable).

1. Craft malicious archive: Create a TAR archive (not a real ZIP) named with a .xpi extension. Include a hard-link entry whose target points to a user-writable file of interest (e.g., ~/.bashrc, ~/.ssh/authorized_keys, or ~/.config/autostart/malicious.desktop).
2. Embed attacker-controlled payload: Set the hard-link entry's content to the desired malicious payload (e.g., a reverse shell command appended to .bashrc, or an attacker's SSH public key in authorized_keys), and configure desired mode bits.
3. Deliver the malicious .xpi: Distribute the crafted file via phishing, a malicious website, or social engineering, prompting the victim to open or install it in Epiphany >= 47.0.
4. Trigger extraction: When the victim opens or installs the .xpi, Epiphany's decompress_xpi_thread() calls libarchive with archive_read_support_format_all(), which accepts the TAR format. libarchive processes the hard-link entry and, due to ARCHIVE_EXTRACT_PERM, truncates and overwrites the targeted file with the attacker's content and mode bits — with no warning dialog shown to the user.
5. Achieve persistence or escalation: The overwritten file (e.g., .bashrc) executes attacker code on the victim's next login or shell invocation, enabling persistent access, credential theft, or further lateral movement within the user's account (Red Hat CVE).

• File System: Unexpectedly modified user files such as ~/.bashrc, ~/.profile, ~/.bash_profile, ~/.ssh/authorized_keys, or files under ~/.config/autostart/ with recent modification timestamps coinciding with a .xpi install event; presence of unknown .xpi files in download directories or Epiphany's extension staging area.
• Logs: System or application logs showing Epiphany opening or installing a .xpi file from an untrusted or external source; libarchive-related log entries indicating TAR format processing during an .xpi extraction.
• Process: Unexpected processes spawned from shell startup scripts (e.g., reverse shells, curl/wget fetching remote payloads) shortly after user login following a .xpi install event.
• Network: Outbound connections to unknown external hosts initiated by shell processes or desktop autostart entries shortly after a .xpi was installed (Red Hat CVE).

The upstream fix is available in GNOME Epiphany via MR !2248 (commit 0cc9ab55), which restricts libarchive to ZIP format only during .xpi extraction, preventing TAR-based exploitation. Users should upgrade to a fixed Epiphany build containing this commit when it becomes available for their distribution stream. As an interim workaround, avoid installing WebExtensions (.xpi files) from untrusted sources, and consider disabling the WebExtension feature in Epiphany if it is not needed. After any untrusted .xpi install attempt, inspect user-writable files such as shell startup scripts, autostart desktop entries, and ~/.ssh/authorized_keys for unexpected modifications (Red Hat CVE).

Red Hat has assessed the vulnerability as Moderate severity, noting that the user-interaction requirement (manually installing a crafted .xpi) limits the practical risk despite the high integrity impact within the user's account. The vulnerability was reported by Fernando Munoz, who is acknowledged by Red Hat Product Security. A Tenable Nessus plugin (ID 373702) has been published to assist in detecting vulnerable Debian epiphany-browser installations (Red Hat CVE, Tenable).