CVE-2026-45150: Zen-Browser Desktop

Medium severity, CVSS 6.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Zen is a firefox-based browser. Prior to 1.19.13b, Zen Browser did not provide a persistent, clearly visible security notification when a webpage entered fullscreen mode, allowing an attacker-controlled page to hide the real browser UI and origin information, imitate a trusted website UI, and combine with long-domain URL eliding to spoof a trusted origin for phishing and credential theft. This issue is fixed in version 1.19.13b.

Affected products

• Zen-Browser Desktop: before 1.19.13b (fixed in 1.19.13b)

Published 2026-07-15. Last modified 2026-07-15.