Security Flaw in Zen Browser Affects Context-Menu Actions
CVE-2026-57501

NONE

Key Information:

Vendor

Zen-browser

Status
Desktop
Vendor
CVE Published:
9 July 2026

What is CVE-2026-57501?

A vulnerability in Zen Browser allows context-menu actions to load page-controlled links with System privileges instead of the appropriate principal. This flaw permits a malicious webpage to execute file URLs, bypassing security checks intended to prevent unauthorized file access when using the 'Open link in glance' and 'Split link in new tab' functionalities. The issue is rectified in version 1.21.5b.

Affected Version(s)

desktop < 1.21.5b

References

https://github.com/zen-browser/desktop/security/advisorie...
x_refsource_CONFIRM
https://github.com/zen-browser/desktop/commit/44f76162382...
x_refsource_MISC
https://github.com/zen-browser/desktop/releases/tag/1.21.5b
x_refsource_MISC

CVSS V3.1

Score:
Severity:
NONE
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.