CVE-2026-44658

Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are validated to http: or https: in promptForFeedUrl, but item links inside the feed are not subject to the same restriction. The provider maps each RSS/Atom item link into item.url, filters only for presence and date, and returns the item list. The live-folder manager later creates pinned lazy tabs from these values with gBrowser.addTrustedTab(item.url, ...). This vulnerability is fixed in 1.19.12b.

• CWE-20

• https://github.com/zen-browser/desktop/security/advisories/GHSA-cc9c-mmmf-c5j6

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44652SillyTavern is a locally installed user interface that allow…6.9
• CVE-2026-44653LibreChat is an enhanced ChatGPT clone that supports multipl…6.5
• CVE-2026-44654LibreChat is an enhanced ChatGPT clone that supports multipl…8.1
• CVE-2026-44655Mantis Bug Tracker (MantisBT) is an open source issue tracke…8.6
• CVE-2026-44656Vim is an open source, command line text editor. Prior to ve…5.3
• CVE-2026-44657Mantis Bug Tracker (MantisBT) is an open source issue tracke…7.5
• CVE-2026-44659Zen is a firefox-based browser. Prior to 1.19.12b, the ZEN B…4.7
• CVE-2026-4466A vulnerability has been found in Comfast CF-AC100 2.6.0.8. …4.7
• CVE-2026-44660UltraJSON is a fast JSON encoder and decoder written in pure…7.5
• CVE-2026-44661python-utcp is the python implementation of UTCP. Prior to 1…4.7
• CVE-2026-44662rust-openssl provides OpenSSL bindings for the Rust programm…5.1
• CVE-2026-44663OpenEXR is the reference implementation and specification fo…7.1