GNOME Epiphany EUVD-2026-114699

Requires the victim to actively install or open an attacker-crafted .xpi WebExtension in Epiphany 47.0 or later, where the installer used archive_read_support_format_all() and thus accepts a TAR file renamed to .xpi rather than a real ZIP. The malicious archive must contain a hard-link entry whose target is an existing, user-writable file that the attacker wishes to overwrite, and extraction runs with archive_write_disk options including ARCHIVE_EXTRACT_PERM so the file's content and mode bits are replaced. Limiting factors: mandatory user interaction (the victim must install/open the package), local delivery of the file, no warning dialog making social engineering easier but still requiring a deliberate install action, and the affected version range (>= 47.0); it is resolved by the fix that enables only ZIP format support.

This is a moderate, user-interaction-gated integrity flaw, not a mass-exploitation priority. The supplied CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, base 5.5) is internally consistent with the description: exploitation is local and requires the victim to actively install or open a malicious .xpi, which is why the vector is AV:L with UI:R rather than a remote drive-by. The sole high-rated impact is integrity (I:H) - an attacker-chosen existing user-writable file is truncated and overwritten with attacker-controlled content and mode bits - with no confidentiality (C:N) or availability (A:N) impact claimed. There is no EPSS score in the supplied data, so exploitation-probability cannot be quantified. This is NOT on CISA KEV, and no proof-of-concept or exploit reference is present - the only links are the Red Hat tracker, the GNOME work item, and the fix merge request. The vuln.today decision label is 'this_month', i.e. a planned-patch priority rather than act_now/emergency, which aligns with the local vector plus mandatory user interaction. The main reason this is more than theoretical is that it needs no special configuration and no warning dialog is shown, but the local-plus-user-interaction requirement keeps real-world risk contained. Note the signals are coherent (no KEV/POC, local vector, moderate CVSS, 'this_month' label all agree) rather than conflicting.

An attacker crafts a TAR archive renamed to a .xpi WebExtension package containing a hard-link entry whose target is an existing user-writable file in the victim's home directory. The attacker delivers it (e.g. via a download link or email) and socially engineers the victim into installing or opening it in Epiphany 47.0 or later; libarchive's format-agnostic extraction accepts the TAR, follows the hard link, and silently truncates and overwrites the targeted file with attacker-controlled content and mode bits. No public exploit is identified at time of analysis, though the trigger mechanism is fully documented in the upstream report.