What is the CVSS score of CVE-2026-44658?

CVE-2026-44658 has a CVSS 3.1 base score of 2.4 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-44658?

Yes, a patch is available for CVE-2026-44658. Update the affected software to the latest version immediately.

Zen Browser CVE-2026-44658

EUVD-2026-29132 LOW

Improper Input Validation (CWE-20)

2026-05-11 GitHub_M

Information Disclosure Mozilla Desktop Zen Browser

2.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

2.4 LOW

AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

May 11, 2026 - 18:17 EUVD

Analysis Generated

May 11, 2026 - 17:49 vuln.today

CVE Published

May 11, 2026 - 17:00 nvd

LOW 2.4

DescriptionGitHub Advisory

Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are validated to http: or https: in promptForFeedUrl, but item links inside the feed are not subject to the same restriction. The provider maps each RSS/Atom item link into item.url, filters only for presence and date, and returns the item list. The live-folder manager later creates pinned lazy tabs from these values with gBrowser.addTrustedTab(item.url, ...). This vulnerability is fixed in 1.19.12b.

AnalysisAI

Zen Browser prior to 1.19.12b fails to validate item links within RSS/Atom feeds, allowing high-privileged users to inject malicious URLs that bypass feed URL restrictions and are opened as trusted tabs. An attacker with administrative or high privileges can craft a malicious RSS feed containing non-HTTP(S) links that are processed without validation and opened with elevated trust, potentially enabling script injection or protocol handler abuse.

Technical ContextAI

The vulnerability stems from an inconsistent validation pattern in Zen Browser's RSS feed handling. The promptForFeedUrl function correctly restricts user-entered RSS feed URLs to http: or https: protocols via CWE-20 (Improper Input Validation). However, this validation is not applied to individual item links extracted from the feed content. The RSS/Atom provider module maps each feed item's link attribute to item.url and performs only presence and date filtering, bypassing URL scheme validation. These unvalidated URLs are subsequently passed to gBrowser.addTrustedTab(item.url, ...), which creates pinned tabs with browser-level trust privileges. This creates a protocol confusion attack vector where non-HTTP schemes (javascript:, data:, file:, etc.) can reach trusted tab creation without validation, violating the principle of consistent input sanitization across related code paths.

RemediationAI

Upgrade Zen Browser to version 1.19.12b or later, which implements URL scheme validation for RSS/Atom item links consistent with feed URL entry validation. Users unable to immediately upgrade should avoid subscribing to RSS feeds from untrusted sources and review subscribed feeds for suspicious content. Administrators can use content policies to restrict RSS feed subscriptions or disable the live-folder feature if RSS functionality is not required. The patch specifically adds validation in the RSS/Atom item processing code path to enforce http: or https: schemes, matching the existing promptForFeedUrl restrictions. See GitHub advisory GHSA-cc9c-mmmf-c5j6 for detailed patch notes.