Zen Browser CVE-2026-57501

NONE

Incorrect Privilege Assignment (CWE-266)

2026-07-09 GitHub_M

Authentication Bypass Mozilla Desktop Zen Browser

Severity by source

Vendor (GitHub_M) PRIMARY

0.0 NONE

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N

vuln.today AI

9.3 CRITICAL

Network attacker, no auth needed, user must right-click (UI:R); System principal crosses browser security boundary (S:C) enabling local file read and potential write (C:H/I:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 23:35 vuln.today

DescriptionCVE.org

Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link to a file URL that can load with System privileges when opened through either context-menu item and bypass the content-to-file security check that blocks an ordinary click. This issue is fixed in version 1.21.5b.

AnalysisAI

System principal privilege escalation in Zen Browser prior to 1.21.5b allows a malicious webpage to bypass Firefox's content-to-file security boundary by exploiting the browser's custom glance and split-view context-menu features. The 'Open link in glance' and 'Split link in new tab' actions navigate attacker-supplied file:// URLs using the System principal rather than the originating page's content principal, granting access to local filesystem contents that would be blocked by an ordinary click. A vendor-released patch exists in version 1.21.5b; no public exploit has been identified at time of analysis.

Technical ContextAI

Zen Browser is a Firefox-based desktop browser (CPE: cpe:2.3:a:zen-browser:desktop:*:*:*:*:*:*:*:*) that extends Firefox's UI with proprietary features including 'glance' - an inline page-preview panel - and split-view tab management. Firefox's security architecture enforces navigation permissions through a principal system: the content principal of an originating page restricts what URLs that page may navigate to, and the content-to-file check specifically blocks web content from loading file:// URLs to prevent local file disclosure. The root cause is CWE-266 (Incorrect Privilege Assignment): Zen's custom context-menu code paths invoke navigation with the System principal - the highest-trust identity in Firefox, normally reserved for browser chrome and internal processes - rather than delegating the correct content principal from the requesting page. This privilege mismatch causes the security subsystem to treat the navigation as internally trusted, entirely skipping the content-to-file boundary check.

RemediationAI

Upgrade Zen Browser to version 1.21.5b or later, which is confirmed as the patched release per the GitHub security advisory GHSA-vpvg-hp3v-rm5q (https://github.com/zen-browser/desktop/security/advisories/GHSA-vpvg-hp3v-rm5q) and the release page at https://github.com/zen-browser/desktop/releases/tag/1.21.5b; the underlying code fix is in commit 44f7616238208200547c7df500d945752d7b6379. If immediate upgrade is not feasible, the only practical compensating control is behavioral: instruct users to avoid using the 'Open link in glance' and 'Split link in new tab' context-menu items on untrusted or unknown web pages. There is no known configuration setting or policy flag to disable only the affected context-menu entries without removing the glance and split-view features entirely. This behavioral workaround cannot be enforced by policy and should be treated as temporary only.