CVE-2026-41431 — Zen Browser Shipped Without Update Signature Verification

CVE: CVE-2026-41431
GHSA: GHSA-qpj9-m8jc-mw6q
Affected: Zen Browser versions built without MAR_CHANNEL_ID
Fixed: April 9, 2026
Credit: Maliq Barnard (FARPSEC)

---

The bug

Zen Browser uses Mozilla's MAR format for updates, same as Firefox. Updates get signed with a private key, the client checks the signature before applying them, and if it doesn't match, the update gets rejected.

Except the build configuration that turns on that check was missing. MAR_CHANNEL_ID — the variable that activates signature verification — wasn't set in Zen's build pipeline. The verification code is there in the binary. It just never ran.

So the updater would accept any MAR file, signed or not. An attacker in position to serve a modified update (compromised network, CDN, DNS) could push arbitrary code and the client would install it without question.

No evidence this was exploited. The update server wasn't compromised. But the client-side check that would catch a tampered update wasn't active.

How this happened

Zen is a fork of Firefox. Mozilla's MAR signing infrastructure exists and works. But MAR_CHANNEL_ID is a build-time environment variable, not something you get automatically by forking the repo. It has to be explicitly set.

Worse: the CI pipeline's path to signmar (the signing tool) was also broken. So CI wasn't producing signed MARs either. These two issues masked each other — if verification had been on, the unsigned updates would've been rejected immediately and the broken signing path would've been obvious.

The fix

Three PRs merged on April 9:

1. MAR_CHANNEL_ID added to the build config, activating signature verification.
2. SMAuthorizedClients Team ID hardened for the macOS updater service.
3. CI signmar path fixed so the pipeline actually signs updates.

Five days from report to fix. Zen team moved fast.

Timeline

| Date | Event |
|---|---|
| April 4, 2026 | Found during build config audit |
| April 4, 2026 | Filed via GitHub Security Advisory (private) |
| April 9, 2026 | Fix merged + hardening PRs merged |
| April 20, 2026 | CVE-2026-41431 assigned |
| April 24, 2026 | Advisory published |