CVE-2026-45150: Zen Browser XSS Vulnerability

CVE-2026-45150 Overview

CVE-2026-45150 is a user interface spoofing vulnerability [CWE-451] affecting Zen Browser, a Firefox-based web browser, in versions prior to 1.19.13b. The browser fails to display a persistent, clearly visible security notification when a webpage enters fullscreen mode. An attacker-controlled page can therefore hide the real browser chrome and origin indicators, then render a convincing imitation of a trusted website's interface. Combined with long-domain URL eliding, this behavior enables the spoofing of trusted origins to conduct phishing attacks and steal credentials. The issue is resolved in Zen Browser version 1.19.13b.

Critical Impact
Attackers can hide the real browser UI during fullscreen mode and imitate trusted websites, enabling credential theft through convincing phishing pages that appear to originate from legitimate domains.

Affected Products

Zen Browser versions prior to 1.19.13b
Fullscreen API rendering component
URL display and origin indicator subsystem

Discovery Timeline

2026-07-15 - CVE-2026-45150 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-45150

Vulnerability Analysis

The vulnerability stems from missing or insufficient user notification when a webpage invokes the Fullscreen API. In a properly designed browser, entering fullscreen mode triggers a persistent overlay indicating the origin currently controlling the display. Zen Browser did not surface this indicator with adequate persistence or visibility, allowing malicious pages to occupy the entire screen without alerting the user.

Once fullscreen mode is active and the origin indicator is absent, the attacker-controlled page can render pixel-accurate replicas of trusted browser chrome, address bars, and website interfaces. Users have no reliable way to distinguish the counterfeit UI from the authentic browser interface.

The attack is compounded by long-domain URL eliding, where the browser truncates lengthy URLs for display. Attackers craft domain names that, when truncated, appear identical to a trusted origin such as a banking or single sign-on portal.

Root Cause

The root cause is an insufficient security indicator when transitioning to fullscreen mode, classified as CWE-451 (User Interface (UI) Misrepresentation of Critical Information). The browser did not enforce a persistent, non-dismissible visual cue anchored to trusted browser chrome that identifies the origin controlling the fullscreen viewport.

Attack Vector

Exploitation requires user interaction. A victim visits an attacker-controlled or compromised page that requests fullscreen access. Once granted, the page draws a fake browser window and target site login form. The user, believing they are interacting with a legitimate service, submits credentials or other sensitive information to the attacker.

The vulnerability is described in prose only because no verified exploitation code is published. See the GitHub Security Advisory for technical details from the maintainers.

Detection Methods for CVE-2026-45150

Indicators of Compromise

Web traffic to newly registered domains with unusually long labels that visually resemble trusted brands after truncation.
Endpoint telemetry showing Zen Browser processes entering fullscreen mode shortly after navigation to untrusted origins.
Credential submissions from browsers running Zen versions earlier than 1.19.13b to domains that do not match the user's stated destination.

Detection Strategies

Inventory installed browser versions across the environment and flag any Zen Browser instance below 1.19.13b.
Correlate DNS resolution logs with proxy or secure web gateway records to surface phishing domains that leverage long-URL eliding patterns.
Monitor password manager events for autofill mismatches, which can indicate that the visible UI does not match the actual origin.

Monitoring Recommendations

Enable URL category filtering and newly observed domain blocking at the network perimeter.
Alert on browser telemetry that shows fullscreen API invocations from low-reputation sites.
Track user-reported phishing incidents and cross-reference with browser version data to identify affected populations.

How to Mitigate CVE-2026-45150

Immediate Actions Required

Upgrade all Zen Browser installations to version 1.19.13b or later without delay.
Communicate the phishing risk to users and instruct them to press Esc if a webpage unexpectedly enters fullscreen mode.
Review recent authentication logs on sensitive applications for anomalous logins that may indicate credential compromise.

Patch Information

Zen Browser version 1.19.13b addresses the vulnerability by introducing a persistent, clearly visible notification when a page enters fullscreen mode. Refer to the GitHub Security Advisory GHSA-vjfv-85qf-v25c for release notes and upgrade instructions.

Workarounds

Restrict or disable the Fullscreen API through browser configuration policies until the update is applied.
Enforce web filtering rules that block access to newly registered or low-reputation domains commonly used in phishing.
Deploy phishing-resistant authentication such as FIDO2 security keys to reduce the impact of credential capture.

bash

# Verify Zen Browser version on Linux endpoints
zen-browser --version

# Example: block fullscreen via enterprise policy (policies.json)
{
  "policies": {
    "Permissions": {
      "Fullscreen": {
        "BlockNewRequests": true
      }
    }
  }
}