CVE-2026-45150CWE-451

Zen Browser - Missing Fullscreen Security Notification Allows Origin Spoofing

Medium · published July 15, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

Zen is a firefox-based browser. Prior to 1.19.13b, Zen Browser did not provide a persistent, clearly visible security notification when a webpage entered fullscreen mode, allowing an attacker-controlled page to hide the real browser UI and origin information, imitate a trusted website UI, and combine with long-domain URL eliding to spoof a trusted origin for phishing and credential theft. This issue is fixed in version 1.19.13b.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS
0.00428 · 36.0th percentile
Weakness
CWE-451 · User Interface (UI) Misrepresentation of Critical Information
Published
2026-07-15T15:35Z
EPSS history
Timeline
  • 15 JUL 15:35Z
    Zen Browser - Missing Fullscreen Security Notification Allows Origin Spoofing
    cvelistv5