Threats affecting pkg:deb/ubuntu/epiphany

A file overwrite vulnerability exists in Epiphany browser when installing WebExtension packages from .xpi files. The vulnerability arises because the installer accepts TAR archives disguised as .xpi files, which can contain hard-link entries. This allows an attacker to overwrite existing user-writable files without warning when the user installs or opens a crafted malicious .xpi file. The issue affects Epiphany versions 47.0 and later and has been fixed by restricting support to ZIP format only.