Zen Browser CVE-2026-45150

Exploitation requires the victim to be running Zen Browser desktop in any version prior to 1.19.13b and to visit an attacker-controlled webpage. Because browsers enforce that fullscreen mode requires a user gesture, the victim must interact with the malicious page (e.g., click a button, play media) - this is the UI:A constraint in the CVSS 4.0 vector. No authentication, elevated privileges, special network position, or non-default browser configuration is required beyond the victim using a vulnerable version. Exploitation is bounded to phishing outcomes (credential theft, UI spoofing); it does not enable remote code execution, memory corruption, or direct access to the host system. The primary limiting factor for defenders is Zen Browser's narrow install base compared to mainstream browsers.

The CVSS 4.0 score of 6.3 with vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N accurately captures the threat profile. The attack is network-accessible and low-complexity for the adversary, but requires active user interaction (UI:A) - the victim must navigate to or interact with the malicious page, as browsers require a user gesture to invoke fullscreen. There is no CISA KEV listing and no public exploit code has been identified, indicating this has not seen opportunistic or widespread exploitation at time of analysis. EPSS data was not provided in the input, so exploitation probability cannot be quantified. The realistic risk is meaningful specifically for targeted phishing campaigns against Zen Browser users but is bounded by Zen's niche market share and the social engineering prerequisite. This is not a remotely exploitable code-execution flaw - impact is limited to UI deception enabling credential theft.

An attacker registers a convincing lookalike domain (e.g., a long subdomain of a legitimate service) and hosts a clone of a target login page. When a Zen Browser user visits the page and clicks a UI element - triggering the required user gesture - the page calls the Fullscreen API, hiding all browser chrome with no persistent warning shown. The victim sees only the attacker's pixel-perfect imitation of the target site's login interface and, believing they are on the legitimate site, submits credentials that are silently exfiltrated to the attacker's server. No public exploit code is known, but the technique is well-understood and requires no specialized tooling.