Zen Browser’s updater previously removed all MAR signature verification, meaning the browser accepted and installed unsigned update files without cryptographic checks. This flaw allows an attacker who can compromise the update server or the release pipeline to deliver arbitrary code to any user who automatically updates their browser, effectively giving the attacker remote code execution capability on those machines. The weakness is a form of weak or missing cryptographic verification (CWE-347).

Zen Browser (zen-browser:desktop) versions earlier than 1.19.9b are vulnerable. These releases use the Mozilla Application Resource (MAR) updater that was forked from Firefox but stripped of all signature and verification code. Users of these versions will receive unsigned MAR packages and have them applied without validation.

The CVSS score for this vulnerability is 8, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, although the risk remains significant because any compromise of the update infrastructure can affect all users. The likely attack vector is a compromised update server or the GitHub release pipeline; from the description it is inferred that the attacker would mount an update supply‑chain attack to inject malicious code. Once a malicious MAR file is served, the unverified updater will install it, allowing the attacker to run arbitrary code.