{"id":"CVE-2026-57501","aliases":["EUVD-2026-42748","GHSA-vpvg-hp3v-rm5q"],"status":"published","title":"Zen: Context-menu \"Open link in glance\" / \"Split link in new tab\" loads a page-controlled link with the System principal, bypassing the web-content scheme restriction","description":"Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link to a file URL that can load with System privileges when opened through either context-menu item and bypass the content-to-file security check that blocks an ordinary click. This issue is fixed in version 1.21.5b.","severity":{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N","level":"none","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00506,"percentile":0.43652,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-266"],"published":"2026-07-09T22:27:34Z","modified":"2026-10-28T02:30:45Z","products":[{"vendor":"zen-browser","product":"desktop"}],"references":[{"url":"https://github.com/zen-browser/desktop/security/advisories/GHSA-vpvg-hp3v-rm5q","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/zen-browser/desktop/commit/44f7616238208200547c7df500d945752d7b6379","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/zen-browser/desktop/releases/tag/1.21.5b","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57501.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57501","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-57501","title":"Zen: Context-menu \"Open link in glance\" / \"Split link in new tab\" loads a page-controlled link with the System principal, bypassing the web-content scheme restriction","description":"Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link to a file URL that can load with System privileges when opened through either context-menu item and bypass the content-to-file security check that blocks an ordinary click. This issue is fixed in version 1.21.5b.","status":"published","published":"2026-07-09T22:27:34.962Z","modified":"2026-07-10T20:59:23.914Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N","level":"none","assessor":"cna"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T13:43:56.024247Z"}],"euvd":[{"id":"EUVD-2026-42748","description":"Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link to a file URL that can load with System privileges when opened through either context-menu item and bypass the content-to-file security check that blocks an ordinary click. This issue is fixed in version 1.21.5b.","status":"published","published":"2026-07-09T22:27:34Z","modified":"2026-07-10T20:59:23Z","updated_at":"2026-11-02T18:20:02.308684Z"}],"nvd":[{"id":"CVE-2026-57501","description":"Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link to a file URL that can load with System privileges when opened through either context-menu item and bypass the content-to-file security check that blocks an ordinary click. This issue is fixed in version 1.21.5b.","status":"published","published":"2026-07-09T23:17:05.353Z","modified":"2026-10-25T15:10:00.147Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N","level":"none","assessor":"secondary"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:12:28.4135Z"}],"osv":[{"id":"CVE-2026-57501","title":"Zen: Context-menu \"Open link in glance\" / \"Split link in new tab\" loads a page-controlled link with the System principal, bypassing the web-content scheme restriction","description":"Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link to a file URL that can load with System privileges when opened through either context-menu item and bypass the content-to-file security check that blocks an ordinary click. This issue is fixed in version 1.21.5b.","status":"published","published":"2026-07-09T22:27:34.962Z","modified":"2026-10-28T02:30:45.32575174Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N","level":"none"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T15:45:12.016252Z"}]}}