CVE-2026-45150: CWE-451: User Interface (UI) Misrepresentation of Critical Information in zen-browser desktop
Zen is a firefox-based browser. Prior to 1.19.13b, Zen Browser did not provide a persistent, clearly visible security notification when a webpage entered fullscreen mode, allowing an attacker-controlled page to hide the real browser UI and origin information, imitate a trusted website UI, and combine with long-domain URL eliding to spoof a trusted origin for phishing and credential theft. This issue is fixed in version 1.19.13b.
AI Analysis
Technical Summary
CVE-2026-45150 is a user interface misrepresentation vulnerability (CWE-451) in the Zen Browser desktop product, which is Firefox-based. Before version 1.19.13b, the browser did not maintain a persistent and clearly visible security notification when a webpage entered fullscreen mode. This flaw allows malicious webpages to hide the real browser UI and origin details, imitate trusted website interfaces, and exploit URL eliding to spoof trusted origins. The vulnerability is addressed in version 1.19.13b.
Potential Impact
An attacker can exploit this vulnerability to mislead users by hiding the browser's real UI and origin information, potentially leading to phishing attacks and credential theft. The CVSS 4.0 base score is 6.3 (medium severity), indicating a network attack vector with low attack complexity and no privileges required, but requiring user interaction. The vulnerability does not involve code execution or data integrity compromise but impacts user trust and security decisions.
Mitigation Recommendations
This vulnerability is fixed in Zen Browser version 1.19.13b. Users and administrators should upgrade to version 1.19.13b or later to remediate this issue. No other official remediation level or temporary fixes are provided. Patch status is not explicitly confirmed in the advisory, but the description states the issue is fixed in 1.19.13b, so updating to this version is the recommended action.
CVE-2026-45150: CWE-451: User Interface (UI) Misrepresentation of Critical Information in zen-browser desktop
Description
Zen is a firefox-based browser. Prior to 1.19.13b, Zen Browser did not provide a persistent, clearly visible security notification when a webpage entered fullscreen mode, allowing an attacker-controlled page to hide the real browser UI and origin information, imitate a trusted website UI, and combine with long-domain URL eliding to spoof a trusted origin for phishing and credential theft. This issue is fixed in version 1.19.13b.
CVSS v4.0
Score 6.3medium
Affected software
pkg:github/zen-browser/desktopRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-45150 is a user interface misrepresentation vulnerability (CWE-451) in the Zen Browser desktop product, which is Firefox-based. Before version 1.19.13b, the browser did not maintain a persistent and clearly visible security notification when a webpage entered fullscreen mode. This flaw allows malicious webpages to hide the real browser UI and origin details, imitate trusted website interfaces, and exploit URL eliding to spoof trusted origins. The vulnerability is addressed in version 1.19.13b.
Potential Impact
An attacker can exploit this vulnerability to mislead users by hiding the browser's real UI and origin information, potentially leading to phishing attacks and credential theft. The CVSS 4.0 base score is 6.3 (medium severity), indicating a network attack vector with low attack complexity and no privileges required, but requiring user interaction. The vulnerability does not involve code execution or data integrity compromise but impacts user trust and security decisions.
Mitigation Recommendations
This vulnerability is fixed in Zen Browser version 1.19.13b. Users and administrators should upgrade to version 1.19.13b or later to remediate this issue. No other official remediation level or temporary fixes are provided. Patch status is not explicitly confirmed in the advisory, but the description states the issue is fixed in 1.19.13b, so updating to this version is the recommended action.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-08T20:44:38.964Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a57af5c68715ace43025099
Added to database: 07/15/2026, 16:03:40 UTC
Last enriched: 07/15/2026, 16:19:19 UTC
Last updated: 07/15/2026, 19:44:00 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.