Epiphany’s WebExtension installer unpacks .xpi files using libarchive without security options, allowing ZIP‑slip path traversal. Archive entries that contain sequences such as "../../.bashrc" are extracted outside the intended web‑extensions directory and can overwrite user‑writable files such as ~/.bashrc, ~/.ssh/authorized_keys, or autostart desktop files. The vulnerability is a CWE‑22 path traversal flaw that can give an attacker persistent code execution on subsequent shell or GNOME logon, provided a user installs or opens a crafted extension bundle. Attackers may also achieve privilege escalation by replacing or inserting executables that run with the user’s credentials.

The vulnerability affects Epiphany Web Browser versions from 47.rc onwards until the security fix in release 49.9 and 50.6. All users running these releases on the GNOME desktop are potentially impacted.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is not publicly available, and the issue is not listed in CISA’s KEV catalog, suggesting no large‑scale public exploitation yet. Exploitation requires user interaction: the victim must install or open a malicious .xpi file, which can be delivered through an untrusted extension source. If successful, the attacker can overwrite configuration files to achieve persistence on future logins. The attack vector is local with user‑initiated installation. Updated releases (49.9, 50.6) mitigate the flaw by enabling secure extraction options.