NVD Vulnerability Detail
Search Exploit, PoC
CVE-2026-44659
Summary

Zen is a firefox-based browser. Prior to 1.19.12b, the ZEN Browser incorrectly truncates long hostnames in the address bar and shows only the attacker-controlled prefix of the subdomain, hiding the actual registrable domain (eTLD+1). As a result, an attacker can craft extremely long malicious subdomains that visually imitate trusted brands, and the browser will display only the spoofed prefix, misleading users about the actual origin of the site. This directly compromises the URL bar as a security indicator and creates a phishing/supply-chain attack vector. This vulnerability is fixed in 1.19.12b.

Publication Date May 12, 2026, 3:16 a.m.
Registration Date May 12, 2026, 4:15 a.m.
Last Update May 12, 2026, 3:16 a.m.
CVSS3.1 : MEDIUM
スコア 4.7
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
攻撃元区分(AV) ネットワーク
攻撃条件の複雑さ(AC)
攻撃に必要な特権レベル(PR) 不要
利用者の関与(UI)
影響の想定範囲(S) 変更あり
機密性への影響(C) なし
完全性への影響(I)
可用性への影響(A) なし
Related information, measures and tools
Common Vulnerabilities List