CVE-2026-44658

Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are validated to http: or https: in promptForFeedUrl, but item links inside the feed are not subject to the same restriction. The provider maps each RSS/Atom item link into item.url, filters only for presence and date, and returns the item list. The live-folder manager later creates pinned lazy tabs from these values with gBrowser.addTrustedTab(item.url, ...). This vulnerability is fixed in 1.19.12b.

CVSS v3 2.4 LOW

2.4^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/zen-browser/desktop/security/advisories/GHSA-cc9c-mmmf-c5j6

Configurations

No configuration.

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Zen es un navegador basado en Firefox. Antes de la versión 1.19.12b, las URL de feeds RSS introducidas por el usuario se validan para http: o https: en promptForFeedUrl, pero los enlaces de elementos dentro del feed no están sujetos a la misma restricción. El proveedor mapea cada enlace de elemento RSS/Atom a item.url, filtra solo por presencia y fecha, y devuelve la lista de elementos. El gestor de carpetas en vivo más tarde crea pestañas perezosas ancladas a partir de estos valores con gBrowser.addTrustedTab(item.url, ...). Esta vulnerabilidad se corrige en la versión 1.19.12b.

Information

Published : 2026-05-11 18:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-44658

Mitre link : CVE-2026-44658

CVE.ORG link : CVE-2026-44658

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2026-44658", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44658", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T18:22:28.229614Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 0.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "zen-browser", "product": "desktop", "versions": [{"status": "affected", "version": "< 1.19.12b"}]}]}], "published": "2026-05-11T18:16:38.243", "references": [{"url": "https://github.com/zen-browser/desktop/security/advisories/GHSA-cc9c-mmmf-c5j6", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are validated to http: or https: in promptForFeedUrl, but item links inside the feed are not subject to the same restriction. The provider maps each RSS/Atom item link into item.url, filters only for presence and date, and returns the item list. The live-folder manager later creates pinned lazy tabs from these values with gBrowser.addTrustedTab(item.url, ...). This vulnerability is fixed in 1.19.12b."}, {"lang": "es", "value": "Zen es un navegador basado en Firefox. Antes de la versi\u00f3n 1.19.12b, las URL de feeds RSS introducidas por el usuario se validan para http: o https: en promptForFeedUrl, pero los enlaces de elementos dentro del feed no est\u00e1n sujetos a la misma restricci\u00f3n. El proveedor mapea cada enlace de elemento RSS/Atom a item.url, filtra solo por presencia y fecha, y devuelve la lista de elementos. El gestor de carpetas en vivo m\u00e1s tarde crea pesta\u00f1as perezosas ancladas a partir de estos valores con gBrowser.addTrustedTab(item.url, ...). Esta vulnerabilidad se corrige en la versi\u00f3n 1.19.12b."}], "lastModified": "2026-10-26T18:10:00.173", "sourceIdentifier": "security-advisories@github.com"}