Zen Browser
Monthly
Zen Browser's auto-update mechanism delivered unsigned code to all users due to deliberately removed MAR signature verification inherited from Firefox. The browser shipped with Mozilla's updater binary stripped of all cryptographic verification code and served update packages containing zero cryptographic signatures. Compromise of the update server or GitHub Actions pipeline allowed arbitrary code execution on all Zen installations without cryptographic chain-of-trust protection. Version 1.19.9b restores MAR signing with RSA-4096 keys and certificate verification in the updater binary.
Fullscreen mode in Zen Browser desktop prior to 1.19.13b exposes users to credential-theft phishing by failing to display a persistent, visible security notification when a webpage enters fullscreen. An attacker-controlled page can completely occlude the real browser chrome - including the address bar and origin indicators - then render a convincing imitation of a trusted site's login interface. When combined with long-domain URL eliding, this allows precise origin spoofing; no public exploit has been identified at time of analysis, and the CVSS 4.0 score of 6.3 reflects high subsequent-system integrity and confidentiality impacts despite the attack requiring user interaction.
System principal privilege escalation in Zen Browser prior to 1.21.5b allows a malicious webpage to bypass Firefox's content-to-file security boundary by exploiting the browser's custom glance and split-view context-menu features. The 'Open link in glance' and 'Split link in new tab' actions navigate attacker-supplied file:// URLs using the System principal rather than the originating page's content principal, granting access to local filesystem contents that would be blocked by an ordinary click. A vendor-released patch exists in version 1.21.5b; no public exploit has been identified at time of analysis.
Zen Browser prior to version 1.19.12b incorrectly truncates long hostnames in the address bar, displaying only the attacker-controlled subdomain prefix while hiding the actual registrable domain (eTLD+1). This allows attackers to craft malicious URLs with extremely long subdomains that visually impersonate trusted brands, directly compromising the URL bar as a security indicator and enabling phishing and supply-chain attacks. The vulnerability requires user interaction (clicking a malicious link) but affects all users on vulnerable versions. No public exploit code or active exploitation has been identified at this time.
Zen Browser prior to 1.19.12b fails to validate item links within RSS/Atom feeds, allowing high-privileged users to inject malicious URLs that bypass feed URL restrictions and are opened as trusted tabs. An attacker with administrative or high privileges can craft a malicious RSS feed containing non-HTTP(S) links that are processed without validation and opened with elevated trust, potentially enabling script injection or protocol handler abuse.
Zen Browser's auto-update mechanism delivered unsigned code to all users due to deliberately removed MAR signature verification inherited from Firefox. The browser shipped with Mozilla's updater binary stripped of all cryptographic verification code and served update packages containing zero cryptographic signatures. Compromise of the update server or GitHub Actions pipeline allowed arbitrary code execution on all Zen installations without cryptographic chain-of-trust protection. Version 1.19.9b restores MAR signing with RSA-4096 keys and certificate verification in the updater binary.
Fullscreen mode in Zen Browser desktop prior to 1.19.13b exposes users to credential-theft phishing by failing to display a persistent, visible security notification when a webpage enters fullscreen. An attacker-controlled page can completely occlude the real browser chrome - including the address bar and origin indicators - then render a convincing imitation of a trusted site's login interface. When combined with long-domain URL eliding, this allows precise origin spoofing; no public exploit has been identified at time of analysis, and the CVSS 4.0 score of 6.3 reflects high subsequent-system integrity and confidentiality impacts despite the attack requiring user interaction.
System principal privilege escalation in Zen Browser prior to 1.21.5b allows a malicious webpage to bypass Firefox's content-to-file security boundary by exploiting the browser's custom glance and split-view context-menu features. The 'Open link in glance' and 'Split link in new tab' actions navigate attacker-supplied file:// URLs using the System principal rather than the originating page's content principal, granting access to local filesystem contents that would be blocked by an ordinary click. A vendor-released patch exists in version 1.21.5b; no public exploit has been identified at time of analysis.
Zen Browser prior to version 1.19.12b incorrectly truncates long hostnames in the address bar, displaying only the attacker-controlled subdomain prefix while hiding the actual registrable domain (eTLD+1). This allows attackers to craft malicious URLs with extremely long subdomains that visually impersonate trusted brands, directly compromising the URL bar as a security indicator and enabling phishing and supply-chain attacks. The vulnerability requires user interaction (clicking a malicious link) but affects all users on vulnerable versions. No public exploit code or active exploitation has been identified at this time.
Zen Browser prior to 1.19.12b fails to validate item links within RSS/Atom feeds, allowing high-privileged users to inject malicious URLs that bypass feed URL restrictions and are opened as trusted tabs. An attacker with administrative or high privileges can craft a malicious RSS feed containing non-HTTP(S) links that are processed without validation and opened with elevated trust, potentially enabling script injection or protocol handler abuse.