What is the CVSS score of CVE-2026-44659?

CVE-2026-44659 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-44659?

Yes, a patch is available for CVE-2026-44659. Update the affected software to the latest version immediately.

Zen Browser CVE-2026-44659

EUVD-2026-29133 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-05-11 GitHub_M

Information Disclosure Mozilla Desktop Zen Browser

4.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.7 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

May 11, 2026 - 18:17 EUVD

Analysis Generated

May 11, 2026 - 18:01 vuln.today

CVE Published

May 11, 2026 - 17:01 nvd

MEDIUM 4.7

DescriptionGitHub Advisory

Zen is a firefox-based browser. Prior to 1.19.12b, the ZEN Browser incorrectly truncates long hostnames in the address bar and shows only the attacker-controlled prefix of the subdomain, hiding the actual registrable domain (eTLD+1). As a result, an attacker can craft extremely long malicious subdomains that visually imitate trusted brands, and the browser will display only the spoofed prefix, misleading users about the actual origin of the site. This directly compromises the URL bar as a security indicator and creates a phishing/supply-chain attack vector. This vulnerability is fixed in 1.19.12b.

AnalysisAI

Zen Browser prior to version 1.19.12b incorrectly truncates long hostnames in the address bar, displaying only the attacker-controlled subdomain prefix while hiding the actual registrable domain (eTLD+1). This allows attackers to craft malicious URLs with extremely long subdomains that visually impersonate trusted brands, directly compromising the URL bar as a security indicator and enabling phishing and supply-chain attacks. The vulnerability requires user interaction (clicking a malicious link) but affects all users on vulnerable versions. No public exploit code or active exploitation has been identified at this time.

Technical ContextAI

Zen Browser is a Firefox-based browser that inherits rendering and address bar functionality from Mozilla Firefox. The vulnerability exists in the hostname parsing and display logic of the address bar component (CWE-451: User Interface Inconsistency), which fails to properly handle extremely long hostnames. When a user visits a URL with an excessively long subdomain, the browser's truncation mechanism displays only the initial portion of the hostname, typically the attacker-controlled prefix, rather than the registrable domain (eTLD+1, such as 'example.com') that should be highlighted to convey site origin. This creates a discrepancy between the actual origin of the resource being loaded and what the user perceives from the address bar display.

RemediationAI

Users must upgrade Zen Browser to version 1.19.12b or later, which contains the fix for hostname truncation in the address bar. The patch corrects the truncation logic to ensure the registrable domain (eTLD+1) remains visible even when subdomains are extremely long, allowing the address bar to continue functioning as a reliable security indicator. Users should check for updates via Help > About Zen Browser or the browser's automatic update mechanism. No workarounds are available for users unable to immediately patch, though disabling navigation to untrusted URLs and verifying site legitimacy through other means (HTTPS certificate inspection, direct navigation to known URLs) provides partial mitigation. See the GitHub security advisory at https://github.com/zen-browser/desktop/security/advisories/GHSA-7p2r-fp29-9w69 for confirmation of the fix.