Hi,

The following vulnerability was published for epiphany-browser.

CVE-2026-118599[0]:
| A file overwrite vulnerability exists in Epiphany when installing
| WebExtension packages from .xpi files.  In src/webextension/ephy-
| web-extension-manager.c, decompress_xpi_thread() used libarchive
| with archive_read_support_format_all() (and filters), so the
| installer did not require a real ZIP. A TAR file named *.xpi was
| extracted. TAR supports hard-link entry types; with Epiphany's
| archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a
| crafted hard-link target can cause an attacker-chosen existing user-
| writable file to be truncated and overwritten with attacker-
| controlled content and mode bits, without a dedicated warning
| dialog, when the user installs or opens the crafted .xpi.  This is
| related to but separate from the ZIP-slip path traversal fixed as
| CVE-2026-77679 (#2922 / MR !2143).  Requirements: the victim must
| install or open a malicious WebExtension (.xpi).  Affected: Epiphany
| >= 47.0 (WebExtension XPI install path). Fixed:
| https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248
| (commit 0cc9ab55 — only enable ZIP format support). Upstream:
| https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter
| acknowledgment: Fernando Munoz


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-118599
https://www.cve.org/CVERecord?id=CVE-2026-118599
[1] https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988
[2] https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248
[3] https://gitlab.gnome.org/GNOME/epiphany/-/commit/0cc9ab5506689a4b82a4b1a41ad71e895cfa48d4

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
epiphany-browser, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1152825@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jeremy Bícha <jbicha@ubuntu.com> (supplier of updated epiphany-browser package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 02 Nov 2026 13:13:58 +0100
Source: epiphany-browser
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 51.2-1
Distribution: unstable
Urgency: high
Maintainer: Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org>
Changed-By: Jeremy Bícha <jbicha@ubuntu.com>
Closes: 1152824 1152825 1152827
Changes:
 epiphany-browser (51.2-1) unstable; urgency=high
 .
   * New upstream release
     - SECURITY UPDATE
     - CVE-2026-118598 Allowing a Clipboard or Website-Data-Access prompt
       grants camera AND microphone access (Closes: #1152824)
     - CVE-2026-118599 XPI extraction allows hard-link targets -  TAR .xpi
       overwrites an existing user file (Closes: #1152825)
     - CVE-2026-115683 TLS/SSL Error Page Bypass
       window.webkit.messageHandlers.tlsErrorPage (Closes: #1152827)
Checksums-Sha1:
 f6537f8cc57a08683a5403c9b1e6135bd2194ef0 2696 epiphany-browser_51.2-1.dsc
 22faa18fbdf7a07e28bfafbec0c0dc5258a902bd 4619612 epiphany-browser_51.2.orig.tar.xz
 8b79e0d131cdafb0515161d9593ae611f856cd91 44872 epiphany-browser_51.2-1.debian.tar.xz
 05ae94f4ea2ee5b9053819acc8685f72295cfda5 11665 epiphany-browser_51.2-1_source.buildinfo
Checksums-Sha256:
 9c6af929963aa8c5ba9ef49154a319c8ccca0cf784151c5776b03bdfdc29bee4 2696 epiphany-browser_51.2-1.dsc
 e45d93483d62beeb26b36b39fe2f8cb5511ffe6ddccc7fedff55b1e3cc0a5c30 4619612 epiphany-browser_51.2.orig.tar.xz
 ded726da11deb42f9648ed88f5f84c32a934c75248d8c19401b49284cb1c8f79 44872 epiphany-browser_51.2-1.debian.tar.xz
 81d8c52b4887fc9a6b743174ae0bc19f1adb72ecd11af8a39f60879c5bf49782 11665 epiphany-browser_51.2-1_source.buildinfo
Files:
 d40bce0834265cce9cc99dd77350b820 2696 gnome optional epiphany-browser_51.2-1.dsc
 f83b46ec377748346f4ba3450c95dba1 4619612 gnome optional epiphany-browser_51.2.orig.tar.xz
 8f782e96dc8e08ff33f9bb207ea476ea 44872 gnome optional epiphany-browser_51.2-1.debian.tar.xz
 c2cf51932a0732477e32bee83c283002 11665 gnome optional epiphany-browser_51.2-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmrofp4ACgkQ5mx3Wuv+
bH1Oxw//ekvUeLlP83pYxTIcQCKVFZ4TMCtAulWk0+8ncUAVN7z9ompsp72ISRKL
UdJqpCr0v6R72XAnVbFTHlcgrB8TSW23KswmjcwvFhz2xNW7pLJABi2DaqfchVy5
v93V3x1DV2EwWsZfjQXU4K3G5NFtjE4aE90rU/Pf4qGWJR9V6xu439L8Jdk5H5eP
G32L+H6y6Y5Y2/wiFMSTdInTq1KQFvSQ+OMr6HOWPJ4d4GVQf4NB0+cDOwA5s0Du
UkO37ZD2cQTxx/pO4aYPuVstfK3vFR/hZSts1IUw9XJ0ObTZ1Tjhu4oO1WT842D7
jE3LddSaDxatpADuZTM6Lhz/cQE/WsSBtMnUixaDGiSiqBEIMQDWWRrAW6UEzCiQ
yZveA/INpF90ZOYhyHjIgvUdasLC4QjbpbcZX4rYsLi2L/nHv0O6CP1Zgdifyaie
vdd/xuzFXaTaiMrmojTys5FosWnMCJ39tHAZFKvTZb1xctoU/dztdHV0efQ59SL/
fup1RfFBY+lJ/XddLR6VWknaL6ztXd1/lbLiurxvJ2M/zpnWWiJwckUAv0Vpcipp
UCh8PLIIKiZiMmLQVlpuXApnB0Tm3cTDfNI6UDO9guprX16x/7wP7/I8qfebH7ll
LV+G8jdvwO4wzUdDX8cdQVkxzLJ8F+Jq44Yx+qNZsqn890c2D1Y=
=lioa
-----END PGP SIGNATURE-----