CVE-2026-44658 Zen Browser: RSS Live-Folder Item URLs Are Not Scheme-Restricted Before Trusted Tab Creation
Attackers can execute arbitrary code or bypass security controls by crafting RSS feeds with malicious item URLs that bypass scheme restrictions in Zen Browser.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-44658?
CVE-2026-44658 is a low-severity vulnerability in zen-browser desktop, published on 11 May 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are validated to http: or https: in promptForFeedUrl, but item links inside the feed are not subject to the same restriction. The provider maps each RSS/Atom item link into item.url, filters only for presence and date, and returns the item list. The live-folder manager later creates pinned lazy tabs from these values with gBrowser.addTrustedTab(item.url, ...). This vulnerability is fixed in 1.19.12b.
Weakness: CWE-20
Which versions are affected by CVE-2026-44658?
How do I fix CVE-2026-44658?
No fix has been published for CVE-2026-44658 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-44658 being exploited?
There is no known exploitation of CVE-2026-44658 in the wild and no public exploit code.
Sources
Also known as GHSA-cc9c-mmmf-c5j6.