CVE-2026-45150
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Zen Browser prior to version 1.19.13b did not provide a persistent, clearly visible security notification when a webpage entered fullscreen mode. This allowed an attacker-controlled page to hide the real browser UI and origin information, imitate a trusted website UI, and combine with long-domain URL eliding to spoof a trusted origin for phishing and credential theft.
Risk Assessment
The risk involves potential phishing attacks and credential theft, as users may be deceived by a fake trusted website interface.
Recommendation
Immediately update Zen Browser to version 1.19.13b or later, which contains the fix for this vulnerability.
Other vulnerabilities in Zen Browser
See all- CVE-2026-57501Unknown
In the Firefox-based Zen browser, prior to version 1.21.5b, the glance and split-view context-menu actions loaded link URLs with the System principal instead of the originating page's principal. This allowed a malicious web page to place a link to a file URL that could bypass the content-to-file security check when opened through these menu items.
- CVE-2026-44659Medium
Zen, a Firefox-based browser, prior to 1.19.12b incorrectly truncates long hostnames in the address bar, showing only the attacker-controlled subdomain prefix and hiding the actual registrable domain (eTLD+1). An attacker can craft extremely long malicious subdomains that visually imitate trusted brands, misleading users about the site's true origin.
Original NVD description (English source)
Zen is a firefox-based browser. Prior to 1.19.13b, Zen Browser did not provide a persistent, clearly visible security notification when a webpage entered fullscreen mode, allowing an attacker-controlled page to hide the real browser UI and origin information, imitate a trusted website UI, and combine with long-domain URL eliding to spoof a trusted origin for phishing and credential theft. This issue is fixed in version 1.19.13b.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS