Is there a patch available for CVE-2026-45150?

Yes, a patch is available for CVE-2026-45150. Update the affected software to the latest version immediately.

Zen Browser CVE-2026-45150

Q: What is the CVSS score of CVE-2026-45150?

CVE-2026-45150 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-44703 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-15 GitHub_M

Information Disclosure Mozilla Desktop Zen Browser

6.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network-delivered phishing attack requiring user interaction (UI:R); scope changes externally (S:C) as victim trust decisions are undermined; low C and I reflect credential-theft risk rather than direct system compromise.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 17:48 EUVD

Analysis Generated

Jul 15, 2026 - 16:19 vuln.today

DescriptionCVE.org

Zen is a firefox-based browser. Prior to 1.19.13b, Zen Browser did not provide a persistent, clearly visible security notification when a webpage entered fullscreen mode, allowing an attacker-controlled page to hide the real browser UI and origin information, imitate a trusted website UI, and combine with long-domain URL eliding to spoof a trusted origin for phishing and credential theft. This issue is fixed in version 1.19.13b.

AnalysisAI

Fullscreen mode in Zen Browser desktop prior to 1.19.13b exposes users to credential-theft phishing by failing to display a persistent, visible security notification when a webpage enters fullscreen. An attacker-controlled page can completely occlude the real browser chrome - including the address bar and origin indicators - then render a convincing imitation of a trusted site's login interface. When combined with long-domain URL eliding, this allows precise origin spoofing; no public exploit has been identified at time of analysis, and the CVSS 4.0 score of 6.3 reflects high subsequent-system integrity and confidentiality impacts despite the attack requiring user interaction.

Technical ContextAI

Zen Browser is a Firefox-based desktop browser (CPE: cpe:2.3:a:zen-browser:desktop:*:*:*:*:*:*:*:*) that exposes the standard browser Fullscreen API inherited from its Gecko engine. The root cause is CWE-451 (User Interface Misrepresentation of Critical Information): browsers are expected to display a persistent, dismissible notification when a page enters fullscreen so users can identify that their browser chrome has been hidden. Zen Browser prior to 1.19.13b lacked this safeguard, meaning attacker-controlled content could fill the entire screen without the user being warned that the native UI was suppressed. The CVSS 4.0 vector's SC:H/SI:H (no direct vulnerable-system impact, but high subsequent-system confidentiality and integrity impact) correctly models this: the browser process itself is not compromised, but the user's external trust decisions and credentials are at severe risk.

RemediationAI

Upgrade Zen Browser desktop to version 1.19.13b or later, which introduces a persistent, clearly visible security notification when a webpage enters fullscreen mode. This is the only confirmed fix per the vendor advisory at https://github.com/zen-browser/desktop/security/advisories/GHSA-vjfv-85qf-v25c. No documented workarounds exist. As a compensating control, organizations or users who cannot upgrade immediately may consider restricting JavaScript permissions via content security policies or browser extensions that block the Fullscreen API - note that disabling the Fullscreen API will break legitimate uses such as video players and web-based presentation tools. User education about verifying the browser address bar remains relevant but is insufficient as a standalone defense given the nature of this attack.