CVE-2026-45150: medium-severity vulnerability in zen-browser desktop
Zen Browser - Missing Fullscreen Security Notification Allows Origin Spoofing
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 0.3%
Zen is a firefox-based browser. Prior to 1.19.13b, Zen Browser did not provide a persistent, clearly visible security notification when a webpage entered fullscreen mode, allowing an attacker-controlled page to hide the real browser UI and origin information, imitate a trusted website UI, and combine with long-domain URL eliding to spoof a trusted origin for phishing and credential theft. This issue is fixed in version 1.19.13b.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Affected products
zen-browser · desktopRelated CVEs — zen-browser desktop
In the same product, most dangerous first.
CVE-2026-57501NONEZen: Context-menu "Open link in glance" / "Split link in new tab" loads a page-controlled link with the System principal, bypassing the web-content scheme restrictionEPSS 0.5%CVE-2026-41431HIGHZen Browser MAR updater ships with signature verification removed — unsigned updates acceptedEPSS 0.2%CVE-2026-44659MEDIUMZen Browser Mac - Address Bar Spoofing via Long SubdomainEPSS 0.2%CVE-2026-44658LOWZen Browser: RSS Live-Folder Item URLs Are Not Scheme-Restricted Before Trusted Tab CreationEPSS 0.2%