CVE-2026-45150: falha de média gravidade em zen-browser desktop
Zen Browser - Missing Fullscreen Security Notification Allows Origin Spoofing
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 0.3%
Zen is a firefox-based browser. Prior to 1.19.13b, Zen Browser did not provide a persistent, clearly visible security notification when a webpage entered fullscreen mode, allowing an attacker-controlled page to hide the real browser UI and origin information, imitate a trusted website UI, and combine with long-domain URL eliding to spoof a trusted origin for phishing and credential theft. This issue is fixed in version 1.19.13b.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Produtos afetados
zen-browser · desktopCVEs relacionadas — zen-browser desktop
No mesmo produto, das mais perigosas para as menos.
CVE-2026-57501NONEZen: Context-menu "Open link in glance" / "Split link in new tab" loads a page-controlled link with the System principal, bypassing the web-content scheme restrictionEPSS 0.5%CVE-2026-41431HIGHZen Browser MAR updater ships with signature verification removed — unsigned updates acceptedEPSS 0.2%CVE-2026-44659MEDIUMZen Browser Mac - Address Bar Spoofing via Long SubdomainEPSS 0.2%CVE-2026-44658LOWZen Browser: RSS Live-Folder Item URLs Are Not Scheme-Restricted Before Trusted Tab CreationEPSS 0.2%