PT-2026-39659 · Unknown · Zen Browser

Smoke-Wolf · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-41431

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zen Browser versions prior to 1.19.9b

Description Zen Browser includes a Mozilla Application Resource (MAR) updater (org.mozilla.updater) that lacks cryptographic signature verification. Because the updater binary contains no verification code and the MAR files contain no signatures, the defense-in-depth mechanism provided by MAR signing is absent. If the update server or GitHub release pipeline is compromised, an attacker could deliver arbitrary unsigned code to users through the auto-update mechanism.

Recommendations Update to version 1.19.9b.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-41431

GHSA-QPJ9-M8JC-MW6Q

Affected Products

Zen Browser

References · 7

• 🔥 https://github.com/zen-browser/desktop/security/advisories/GHSA-qpj9-m8jc-mw6q · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41431.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41431 · Security Note
• https://osv.dev/vulnerability/CVE-2026-41431 · Vendor Advisory
• https://github.com/zen-browser/desktop/commit/270db6d6713d2c6c14d9df0b4bc7662843d3d54e · Note
• https://twitter.com/CVEnew/status/2053932416977485909 · Twitter Post
• https://twitter.com/KaitanSecurity/status/2053913034603495560 · Twitter Post