CVE-2026-45150: Zen Browser - Missing Fullscreen Security Notification Allows Origin Spoofing

Severity: medium (CVSS 6.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-15 · updated 2026-10-24
Weakness: CWE-451

Description

Zen is a firefox-based browser. Prior to 1.19.13b, Zen Browser did not provide a persistent, clearly visible security notification when a webpage entered fullscreen mode, allowing an attacker-controlled page to hide the real browser UI and origin information, imitate a trusted website UI, and combine with long-domain URL eliding to spoof a trusted origin for phishing and credential theft. This issue is fixed in version 1.19.13b.

Affected products

zen-browser desktop: before 1.19.13b

References

https://github.com/zen-browser/desktop/security/advisories/GHSA-vjfv-85qf-v25c
https://github.com/zen-browser/desktop/security/advisories/GHSA-vjfv-85qf-v25c

Get alerted when CVE-2026-45150 or the next vulnerability affects your stack