Zen Browser CVE-2026-57501

Exploitation requires the victim to be running Zen Browser desktop prior to version 1.21.5b - other Firefox-based browsers without the glance/split-view context-menu features are unaffected. The attacker must serve a webpage the victim visits containing an anchor whose href is a file:// URL pointing to a target local resource. The critical limiting condition is mandatory active user interaction: the victim must manually right-click the attacker's link and deliberately select either 'Open link in glance' or 'Split link in new tab' from the context menu - a standard left-click on the same link is blocked by the content-to-file check and does not trigger the vulnerability. The CVSS PR:N metric indicates no attacker authentication is required against the victim's system. Exploitation is not automatable and cannot be triggered silently or by script injection; it depends entirely on a user completing a deliberate, non-default right-click workflow.

The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N) carries a base score of 0.0 because all impact metrics are set to None - this is almost certainly a data entry error or placeholder and does not reflect the actual severity of the vulnerability. The true impact of System principal access to local file URLs is material: a local file disclosure primitive at minimum (C:H) with potential integrity implications (I:H) if writable local resources can be targeted. No EPSS score is available and the vulnerability does not appear in CISA KEV, indicating no confirmed active exploitation. Exploitation is constrained by a mandatory user interaction step (right-click and deliberate context-menu selection), which prevents automated or drive-by exploitation and reduces the practical attack surface. However, social engineering - embedding a seemingly harmless 'open this document' invitation on a malicious page - is a realistic delivery path. Risk is meaningful for Zen Browser users but scope is inherently bounded by the browser's limited enterprise deployment footprint.

An attacker publishes a webpage containing a hyperlink whose href points to a sensitive local file such as file:///etc/shadow or file:///C:/Users/victim/.ssh/id_rsa, styled to appear as legitimate document content. When a Zen Browser user visits the page and right-clicks the link to select 'Open link in glance' or 'Split link in new tab', the browser loads the file:// URL under the System principal, rendering the local file's contents directly in the glance panel or split tab. No public exploit code has been identified at time of analysis.