CVE-2026-44658: Zen-Browser Desktop

Low severity, CVSS 2.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are validated to http: or https: in promptForFeedUrl, but item links inside the feed are not subject to the same restriction. The provider maps each RSS/Atom item link into item.url, filters only for presence and date, and returns the item list. The live-folder manager later creates pinned lazy tabs from these values with gBrowser.addTrustedTab(item.url, ...). This vulnerability is fixed in 1.19.12b.

Affected products

• Zen-Browser Desktop: before 1.19.12b (fixed in 1.19.12b)

Published 2026-05-11. Last modified 2026-06-17.