CVE-2026-41431

Zen is a firefox-based browser. Prior to 1.19.9b, Zen Browser ships a Mozilla Application Resource (MAR) updater (org.mozilla.updater) that has had all MAR signature verification stripped from the Firefox codebase it was forked from. The MAR files served to users contain zero cryptographic signatures, and the updater binary contains zero cryptographic verification code. This eliminates the defense-in-depth that MAR signing provides. If the update server or GitHub release pipeline is compromised, arbitrary unsigned code can be delivered to all Zen users via the auto-update mechanism. This vulnerability is fixed in 1.19.9b.

• CWE-347

• https://github.com/zen-browser/desktop/commit/270db6d6713d2c6c14d9df0b4bc7662843d3d54e
• https://github.com/zen-browser/desktop/security/advisories/GHSA-qpj9-m8jc-mw6q
• https://github.com/zen-browser/desktop/security/advisories/GHSA-qpj9-m8jc-mw6q

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41426pretalx is a conference planning tool. Prior to 2026.1.0, an…6.1
• CVE-2026-41427Better Auth is an authentication and authorization library f…6.5
• CVE-2026-41428Budibase is an open-source low-code platform. Prior to 3.35.…9.1
• CVE-2026-41429arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ES…8.8
• CVE-2026-4143The Neos Connector for Fakturama plugin for WordPress is vul…4.3
• CVE-2026-41430Press, a Frappe custom app that runs Frappe Cloud, manages i…6.1
• CVE-2026-41432New API is a large language mode (LLM) gateway and artificia…8.2
• CVE-2026-41433OpenTelemetry eBPF Instrumentation provides eBPF instrumenta…8.4
• CVE-2026-41434OP-TEE is a Trusted Execution Environment (TEE) designed as …3.3
• CVE-2026-41445KissFFT before commit 8a8e66e contains an integer overflow v…8.8
• CVE-2026-41446Snap One WattBox 800 and 820 series firmware versions prior …9.8
• CVE-2026-41447FirmaCheck for Windows before 1.3.16 contains a DLL hijackin…8.5