CVE-2026-57501
UnknownCVSS 0.0Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
In the Firefox-based Zen browser, prior to version 1.21.5b, the glance and split-view context-menu actions loaded link URLs with the System principal instead of the originating page's principal. This allowed a malicious web page to place a link to a file URL that could bypass the content-to-file security check when opened through these menu items.
Risk Assessment
An attacker could exploit this vulnerability to read or execute local files on the victim's machine, leading to confidentiality and integrity breaches.
Recommendation
Immediately update Zen browser to version 1.21.5b or later, which includes a fix for this vulnerability.
Other vulnerabilities in Zen Browser
See all- CVE-2026-45150Medium
Zen Browser prior to version 1.19.13b did not provide a persistent, clearly visible security notification when a webpage entered fullscreen mode. This allowed an attacker-controlled page to hide the real browser UI and origin information, imitate a trusted website UI, and combine with long-domain URL eliding to spoof a trusted origin for phishing and credential theft.
- CVE-2026-44659Medium
Zen, a Firefox-based browser, prior to 1.19.12b incorrectly truncates long hostnames in the address bar, showing only the attacker-controlled subdomain prefix and hiding the actual registrable domain (eTLD+1). An attacker can craft extremely long malicious subdomains that visually imitate trusted brands, misleading users about the site's true origin.
Original NVD description (English source)
Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link to a file URL that can load with System privileges when opened through either context-menu item and bypass the content-to-file security check that blocks an ordinary click. This issue is fixed in version 1.21.5b.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS