VYPR
← All advisories
Low severity2.4NVD Advisory· Published May 11, 2026· Updated Jun 17, 2026

CVE-2026-44658

CVE-2026-44658

Description

Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are validated to http: or https: in promptForFeedUrl, but item links inside the feed are not subject to the same restriction. The provider maps each RSS/Atom item link into item.url, filters only for presence and date, and returns the item list. The live-folder manager later creates pinned lazy tabs from these values with gBrowser.addTrustedTab(item.url, ...). This vulnerability is fixed in 1.19.12b.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Zen Browser/Desktopinferred2 versions
    <1.19.12b+ 1 more
    • (no CPE)range: <1.19.12b
    • (no CPE)range: <1.19.12b

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.