PT-2026-39675 · Unknown · Zen Browser

Barathstalin6 · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-44659

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zen Browser versions prior to 1.19.12b

Description The browser incorrectly truncates long hostnames in the address bar, displaying only the attacker-controlled prefix of the subdomain and hiding the actual registrable domain (eTLD+1). This allows an attacker to create long malicious subdomains that visually mimic trusted brands, misleading users about the site's origin and compromising the URL bar as a security indicator, which facilitates phishing and supply-chain attacks.

Recommendations Update to version 1.19.12b.

Exploit

Fix

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-451

Related Identifiers

CVE-2026-44659

GHSA-7P2R-FP29-9W69

Affected Products

Zen Browser

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44659.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-44659 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44659 · Security Note
• https://github.com/zen-browser/desktop/security/advisories/GHSA-7p2r-fp29-9w69 · Note
• https://twitter.com/CVEnew/status/2053932414066643178 · Twitter Post