Zen Browser, a Firefox-based desktop browser, used a Mozilla Application Resource (MAR) updater that had all MAR signature verification removed from the original Firefox codebase. Consequently, MAR files served to users contain no cryptographic signatures, and the updater binary does not perform any cryptographic verification. This lack of verification eliminates defense-in-depth protections against tampered or malicious updates. The vulnerability affects all versions prior to 1.19.9b and is addressed by restoring proper signature verification in that fixed release.

An attacker who compromises the update server or the GitHub release pipeline can deliver arbitrary unsigned code to all Zen Browser users running affected versions. This can lead to complete compromise of the affected systems, including confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 8.0, reflecting high impact with network attack vector, high privileges required, no user interaction, and scope change.

This vulnerability is fixed in Zen Browser version 1.19.9b. Users and administrators should upgrade to version 1.19.9b or later to restore cryptographic signature verification for MAR updates. Since the vendor advisory does not provide additional remediation details, patch status beyond this fixed version is not explicitly stated but upgrading to 1.19.9b is the recommended action. Patch status is not yet confirmed beyond this fix; check the vendor advisory for current remediation guidance.