Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2026-41431— Zen Browser MAR updater ships with signature verification removed — unsigned updates accepted

CVSS 8.0 · High EPSS 0.04% · P11
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-41431

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Zen Browser MAR updater ships with signature verification removed — unsigned updates accepted
Source: NVD (National Vulnerability Database)
Vulnerability Description
Zen is a firefox-based browser. Prior to 1.19.9b, Zen Browser ships a Mozilla Application Resource (MAR) updater (org.mozilla.updater) that has had all MAR signature verification stripped from the Firefox codebase it was forked from. The MAR files served to users contain zero cryptographic signatures, and the updater binary contains zero cryptographic verification code. This eliminates the defense-in-depth that MAR signing provides. If the update server or GitHub release pipeline is compromised, arbitrary unsigned code can be delivered to all Zen users via the auto-update mechanism. This vulnerability is fixed in 1.19.9b.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
密码学签名的验证不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Zen 数据伪造问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Zen是Zen开源的一款基于Firefox的高效生产力浏览器。 Zen 1.19.9b之前版本存在数据伪造问题漏洞，该漏洞源于从Firefox代码库剥离了所有MAR签名验证，导致MAR文件包含零加密签名且更新程序包含零加密验证代码，如果更新服务器或GitHub发布管道被攻破，可通过自动更新机制向所有用户提供任意未签名代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
zen-browserdesktop < 1.19.9b -

II. Public POCs for CVE-2026-41431

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-41431

请登录查看更多情报信息。

Same Patch Batch · zen-browser · 2026-05-11 · 3 CVEs total

CVE-2026-446594.7 MEDIUMZen Browser Mac - Address Bar Spoofing via Long Subdomain
CVE-2026-446582.4 LOWZen Browser: RSS Live-Folder Item URLs Are Not Scheme-Restricted Before Trusted Tab Creati

IV. Related Vulnerabilities

Same product: desktop
Same vendor: zen-browser
Same weakness: CWE-347

V. Comments for CVE-2026-41431

No comments yet

Leave a comment