CVE-2026-44658

Description

Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are validated to http: or https: in promptForFeedUrl, but item links inside the feed are not subject to the same restriction. The provider maps each RSS/Atom item link into item.url, filters only for presence and date, and returns the item list. The live-folder manager later creates pinned lazy tabs from these values with gBrowser.addTrustedTab(item.url, ...). This vulnerability is fixed in 1.19.12b.

PUBLISHED Reserved 2026-05-07 | Published 2026-05-11 | Updated 2026-05-11 | Assigner GitHub_M

Problem types

CWE-20: Improper Input Validation

Product status

References

github.com/...esktop/security/advisories/GHSA-cc9c-mmmf-c5j6

cve.org (CVE-2026-44658)

nvd.nist.gov (CVE-2026-44658)

Download JSON