Zen Browser prior to 1.19.12b truncates excessively long hostnames in the URL bar, displaying only the attacker‑controlled subdomain prefix and hiding the real registrable domain (eTLD+1). This compromises the address bar as a trusted security indicator, allowing an attacker to craft long malicious subdomains that visually imitate trusted brands. The result is a phishing or supply‑chain attack vector that misleads users about the actual origin of the website.

Zen Browser, Desktop edition, any release earlier than 1.19.12b. The vulnerability exists in all affected versions until the fix is applied via the 1.19.12b release.

The CVSS score is 4.7, indicating moderate severity. EPSS is not available and the vulnerability is not listed in CISA KEV. Attackers exploit the flaw by hosting malicious sites with long subdomains; users who visit such sites will see a spoofed address bar and may trust the site. The lack of availability of EPSS data makes the exact exploitation probability unclear, but the potential for widespread phishing makes this moderate risk.