Zen Browser CVE-2026-57501

NONE

Incorrect Privilege Assignment (CWE-266)

2026-07-09 GitHub_M

Authentication Bypass Mozilla Desktop

Severity by source

Vendor (GitHub_M) PRIMARY

0.0 NONE

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N

vuln.today AI

9.3 CRITICAL

Network attacker, no auth needed, user must right-click (UI:R); System principal crosses browser security boundary (S:C) enabling local file read and potential write (C:H/I:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 23:35 vuln.today

DescriptionCVE.org

Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link to a file URL that can load with System privileges when opened through either context-menu item and bypass the content-to-file security check that blocks an ordinary click. This issue is fixed in version 1.21.5b.

AnalysisAI

System principal privilege escalation in Zen Browser prior to 1.21.5b allows a malicious webpage to bypass Firefox's content-to-file security boundary by exploiting the browser's custom glance and split-view context-menu features. The 'Open link in glance' and 'Split link in new tab' actions navigate attacker-supplied file:// URLs using the System principal rather than the originating page's content principal, granting access to local filesystem contents that would be blocked by an ordinary click. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker hosts page with file:// link

Delivery

Victim visits page in Zen Browser prior to 1.21.5b

Exploit

Victim right-clicks attacker link

Execution

Victim selects 'Open link in glance' or 'Split link in new tab'

Persist

Browser navigates file:// URL with System principal

Impact

Local file contents rendered in browser

Access

Attacker hosts page with file:// link

Delivery

Victim visits page in Zen Browser prior to 1.21.5b

Exploit

Victim right-clicks attacker link

Execution

Victim selects 'Open link in glance' or 'Split link in new tab'

Persist

Browser navigates file:// URL with System principal

Impact

Local file contents rendered in browser

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to be running Zen Browser desktop prior to version 1.21.5b - other Firefox-based browsers without the glance/split-view context-menu features are unaffected. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N) carries a base score of 0.0 because all impact metrics are set to None - this is almost certainly a data entry error or placeholder and does not reflect the actual severity of the vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker publishes a webpage containing a hyperlink whose href points to a sensitive local file such as file:///etc/shadow or file:///C:/Users/victim/.ssh/id_rsa, styled to appear as legitimate document content. When a Zen Browser user visits the page and right-clicks the link to select 'Open link in glance' or 'Split link in new tab', the browser loads the file:// URL under the System principal, rendering the local file's contents directly in the glance panel or split tab. …
Remediation	Upgrade Zen Browser to version 1.21.5b or later, which is confirmed as the patched release per the GitHub security advisory GHSA-vpvg-hp3v-rm5q (https://github.com/zen-browser/desktop/security/advisories/GHSA-vpvg-hp3v-rm5q) and the release page at https://github.com/zen-browser/desktop/releases/tag/1.21.5b; the underlying code fix is in commit 44f7616238208200547c7df500d945752d7b6379. … Detailed patch versions, workarounds, and compensating controls in full report.