PT-2026-39674 · Zen · Zen

0Xstraw-Hat · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-44658

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zen versions prior to 1.19.12b

Description In the promptForFeedUrl() function, RSS feed URLs entered by the user are validated to ensure they use http: or https: protocols. However, item links within the feed are not subject to this restriction. The provider maps each RSS/Atom item link into item.url, filtering only for presence and date. Subsequently, the live-folder manager creates pinned lazy tabs using these values via gBrowser.addTrustedTab(item.url, ...), which can lead to the execution of unauthorized protocols.

Recommendations Update to version 1.19.12b.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-44658

GHSA-CC9C-MMMF-C5J6

Affected Products

Zen

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44658.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-44658 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44658 · Security Note
• https://github.com/zen-browser/desktop/security/advisories/GHSA-cc9c-mmmf-c5j6 · Note
• https://twitter.com/CVEnew/status/2053932415039713280 · Twitter Post