CVE-2026-57501

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57501", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-24T14:53:40.112Z", "datePublished": "2026-07-09T22:27:34.962Z", "dateUpdated": "2026-07-10T20:59:23.914Z"}, "containers": {"cna": {"title": "Zen: Context-menu \"Open link in glance\" / \"Split link in new tab\" loads a page-controlled link with the System principal, bypassing the web-content scheme restriction", "problemTypes": [{"descriptions": [{"cweId": "CWE-266", "lang": "en", "description": "CWE-266: Incorrect Privilege Assignment", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 0, "baseSeverity": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/zen-browser/desktop/security/advisories/GHSA-vpvg-hp3v-rm5q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/zen-browser/desktop/security/advisories/GHSA-vpvg-hp3v-rm5q"}, {"name": "https://github.com/zen-browser/desktop/commit/44f7616238208200547c7df500d945752d7b6379", "tags": ["x_refsource_MISC"], "url": "https://github.com/zen-browser/desktop/commit/44f7616238208200547c7df500d945752d7b6379"}, {"name": "https://github.com/zen-browser/desktop/releases/tag/1.21.5b", "tags": ["x_refsource_MISC"], "url": "https://github.com/zen-browser/desktop/releases/tag/1.21.5b"}], "affected": [{"vendor": "zen-browser", "product": "desktop", "versions": [{"version": "< 1.21.5b", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-09T22:27:34.962Z"}, "descriptions": [{"lang": "en", "value": "Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link to a file URL that can load with System privileges when opened through either context-menu item and bypass the content-to-file security check that blocks an ordinary click. This issue is fixed in version 1.21.5b."}], "source": {"advisory": "GHSA-vpvg-hp3v-rm5q", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-10T20:46:27.753145Z", "id": "CVE-2026-57501", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T20:59:23.914Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57501", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-10T20:46:27.753145Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T20:46:28.535Z"}}], "cna": {"title": "Zen: Context-menu \"Open link in glance\" / \"Split link in new tab\" loads a page-controlled link with the System principal, bypassing the web-content scheme restriction", "source": {"advisory": "GHSA-vpvg-hp3v-rm5q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 0, "attackVector": "NETWORK", "baseSeverity": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "zen-browser", "product": "desktop", "versions": [{"status": "affected", "version": "< 1.21.5b"}]}], "references": [{"url": "https://github.com/zen-browser/desktop/security/advisories/GHSA-vpvg-hp3v-rm5q", "name": "https://github.com/zen-browser/desktop/security/advisories/GHSA-vpvg-hp3v-rm5q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/zen-browser/desktop/commit/44f7616238208200547c7df500d945752d7b6379", "name": "https://github.com/zen-browser/desktop/commit/44f7616238208200547c7df500d945752d7b6379", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/zen-browser/desktop/releases/tag/1.21.5b", "name": "https://github.com/zen-browser/desktop/releases/tag/1.21.5b", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link to a file URL that can load with System privileges when opened through either context-menu item and bypass the content-to-file security check that blocks an ordinary click. This issue is fixed in version 1.21.5b."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "CWE-266: Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-09T22:27:34.962Z"}}}, "cveMetadata": {"cveId": "CVE-2026-57501", "state": "PUBLISHED", "dateUpdated": "2026-07-10T20:59:23.914Z", "dateReserved": "2026-06-24T14:53:40.112Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-09T22:27:34.962Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "desktop", "vendor": "zen-browser", "versions": [{"status": "affected", "version": "< 1.21.5b"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link to a file URL that can load with System privileges when opened through either context-menu item and bypass the content-to-file security check that blocks an ordinary click. This issue is fixed in version 1.21.5b."}, {"lang": "es", "value": "Zen es un navegador basado en Firefox. Antes de la versi\u00f3n 1.21.5b, las acciones del men\u00fa contextual de vista r\u00e1pida (glance) y vista dividida (split-view) de Zen, \u2019Abrir enlace en vista r\u00e1pida\u2019 y \u2019Dividir enlace en nueva pesta\u00f1a\u2019, cargan una URL de enlace controlada por la p\u00e1gina con el principal del Sistema en lugar del principal de la p\u00e1gina de origen, permitiendo que una p\u00e1gina web maliciosa coloque un enlace a una URL de archivo que puede cargarse con privilegios de Sistema cuando se abre a trav\u00e9s de cualquiera de los elementos del men\u00fa contextual y eludir la comprobaci\u00f3n de seguridad de contenido a archivo que bloquea un clic ordinario. Este problema est\u00e1 solucionado en la versi\u00f3n 1.21.5b."}], "id": "CVE-2026-57501", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 0.0, "baseSeverity": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 0.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57501", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-10T20:46:27.753145Z", "version": "2.0.3"}}]}, "published": "2026-07-09T23:17:05.353", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/zen-browser/desktop/commit/44f7616238208200547c7df500d945752d7b6379"}, {"source": "security-advisories@github.com", "url": "https://github.com/zen-browser/desktop/releases/tag/1.21.5b"}, {"source": "security-advisories@github.com", "url": "https://github.com/zen-browser/desktop/security/advisories/GHSA-vpvg-hp3v-rm5q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.21.5b)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "desktop", "source": "cna", "vendor": "zen-browser"}, "product": "desktop", "vendor": "zen-browser"}], "created": "2026-07-09T23:30:16.329100+00:00", "updated": "2026-08-01T13:45:03.056618+00:00", "vendors": ["zen-browser", "zen-browser$PRODUCT$desktop"]}