Executive brief
Zen Browser, a web browser based on Firefox, failed to provide adequate security warnings when a website entered fullscreen mode. This allowed malicious websites to hide the browser's address bar and interface, making it possible to perfectly imitate legitimate websites like banks or email providers. An attacker could use this to trick users into entering sensitive credentials or personal information on a fraudulent page.
Technical details
A UI misrepresentation vulnerability (CWE-451) existed in Zen Browser prior to version 1.19.13b due to the lack of a persistent, non-spoofable security indicator when the Fullscreen API is invoked. By entering fullscreen mode, a malicious site could hide the browser's chrome, including the address bar and origin information. When combined with long-domain URL eliding, an attacker can effectively spoof a trusted origin to conduct credential theft or session hijacking. The vulnerability requires user interaction (e.g., clicking an element) to trigger the fullscreen state. The issue is resolved in version 1.19.13b by ensuring origin visibility is maintained or clearly signaled.
Affected products
- Zen Browser Zen Browser < 1.19.13b
Timeline
- 2026-05-13: advisory: GitHub advisory published by developer
- 2026-07-15: disclosed: CVE published to NVD dataset
- 2026-07-15: patched: Fix confirmed in version 1.19.13b