Zen Browser vulnerabilities

Zen Browser prior to version 1.19.13b did not provide a persistent, clearly visible security notification when a webpage entered fullscreen mode. This allowed an attacker-controlled page to hide the real browser UI and origin information, imitate a trusted website UI, and combine with long-domain URL eliding to spoof a trusted origin for phishing and credential theft.

In the Firefox-based Zen browser, prior to version 1.21.5b, the glance and split-view context-menu actions loaded link URLs with the System principal instead of the originating page's principal. This allowed a malicious web page to place a link to a file URL that could bypass the content-to-file security check when opened through these menu items.

Zen, a Firefox-based browser, prior to 1.19.12b incorrectly truncates long hostnames in the address bar, showing only the attacker-controlled subdomain prefix and hiding the actual registrable domain (eTLD+1). An attacker can craft extremely long malicious subdomains that visually imitate trusted brands, misleading users about the site's true origin.