CVE-2026-44659
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Zen, a Firefox-based browser, prior to 1.19.12b incorrectly truncates long hostnames in the address bar, showing only the attacker-controlled subdomain prefix and hiding the actual registrable domain (eTLD+1). An attacker can craft extremely long malicious subdomains that visually imitate trusted brands, misleading users about the site's true origin.
Risk Assessment
The URL bar ceases to be a reliable security indicator, facilitating phishing and supply-chain attacks against users. This can lead to credential theft.
Recommendation
Update the Zen browser to version 1.19.12b or later. Inform users of the risk and advise verifying full URLs.
Other vulnerabilities in Zen Browser
See all- CVE-2026-45150Medium
Zen Browser prior to version 1.19.13b did not provide a persistent, clearly visible security notification when a webpage entered fullscreen mode. This allowed an attacker-controlled page to hide the real browser UI and origin information, imitate a trusted website UI, and combine with long-domain URL eliding to spoof a trusted origin for phishing and credential theft.
- CVE-2026-57501Unknown
In the Firefox-based Zen browser, prior to version 1.21.5b, the glance and split-view context-menu actions loaded link URLs with the System principal instead of the originating page's principal. This allowed a malicious web page to place a link to a file URL that could bypass the content-to-file security check when opened through these menu items.
Original NVD description (English source)
Zen is a firefox-based browser. Prior to 1.19.12b, the ZEN Browser incorrectly truncates long hostnames in the address bar and shows only the attacker-controlled prefix of the subdomain, hiding the actual registrable domain (eTLD+1). As a result, an attacker can craft extremely long malicious subdomains that visually imitate trusted brands, and the browser will display only the spoofed prefix, misleading users about the actual origin of the site. This directly compromises the URL bar as a security indicator and creates a phishing/supply-chain attack vector. This vulnerability is fixed in 1.19.12b.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS