Zen Browser 1.23.4b ships with a baked-in fix for the eMudhra certificate attack
Zen 1.23.4b lands with Firefox 158.0.1, a new "Focus" mode for Boosts, and a Windows performance tweak.
Zen Browser's newest stable release isn't about the flashy stuff. It's a security patch, plain and simple, and that's kind of the point. Version 1.23.4b went live today, landing right after Mozilla exposed the eMudhra certificate compromise, a genuine web-PKI attack that could let hackers impersonate any website you happen to visit.
The release manager behind the tag is @mr-cheffy, one of the regulars handling Zen's frequent build-and-ship cycle. This is a community project with no parent company and no support desk. It's roughly 45,000 GitHub stars worth of "runs on open-source momentum," and Zen's entire pitch is being "a calmer internet."
Let's get some context first. Zen is a Firefox fork, so it rides Gecko rather than Chromium. You get Firefox's extension ecosystem and Firefox Sync essentially for free. It launched back in July 2024 and quietly carved out a niche as the go-to Arc alternative. When The Browser Company said Arc would stop taking new features, a bunch of users went looking for a successor. Zen showed up with vertical tabs, workspaces, split views, and quick previews, all open source and free.
Why the certificate fix actually matters
Here's the part you should care about. On Saturday, October 17, 2026, Mozilla got a call. Eight intermediate certificates issued by eMudhra (now Knowlarity Digital) had private keys that were compromised. That's a pretty bad spot to be in a certificate authority. A bad actor with those keys can issue fake HTTPS certificates for domains they don't own, then slip in between you and a site to read or rewrite your traffic, banking and email included.
Mozilla moved fast. It blocked the bad certificates via OneCRL, a central revocation list that protects you without a restart, and pushed the update out to standard users in under three hours. But that relies on a background push. If your network blocks that push, or policy disables RemoteSettings, you're on your own until the next full browser update.
Zen sidestepped that problem. Its release notes say the update "contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment." In plain terms, the block is baked directly into the browser binary. You're covered even offline.
That's a resilience call, and it's a defense-in-depth one. For an attacker sitting between you and a real site, it's the difference between a fix that arrives "eventually" and a fix that's already there.
What else is in 1.23.4b
On top of security, Zen pushed the base engine up to Firefox 158.0.1, a full step beyond the 157.0.1 inside the previous build. You inherit Mozilla's latest rendering work and standard support along the way.
There's also a genuinely useful addition. Boosts — Zen's per-site customization system — let you tint colors, swap fonts, nuke page elements, and force dark mode on any site. The 1.23.4b update adds a "Focus" mode that zeroes in on one part of a page, dimming or hiding the surrounding clutter. It fits the "calmer internet" brand without making you change how you browse.
Windows users get a performance bump from CSIR PGO, or Profile-Guided Optimization. The browser compiles against real workloads, then recompiles so the optimizer can place the hot code paths. Zen says performance and startup times improved on Windows, and other platforms get boosts too, even though the headline change is Windows-only.
The bundle also pulls in Mozilla Foundation Security Advisory 2026-111, rated high impact. That covers a handful of specific bugs. CVE-2026-113470 is a cryptographic issue in the security block-lists, directly tied to the OneCRL handling above. CVE-2026-113399 is a boundary-condition bug in SVG. You also inherit an audio/video memory flaw (CVE-2026-113400) and a PDF-viewer denial-of-service (CVE-2026-113401).
Zen always ships a grab bag of smaller fixes, and this one's no exception. Sidebar-hiding behavior when your mouse sits still on it gets sorted. Glance tabs now show Devtools. Multiple windows launching on startup on Linux and Windows finally stops. There's a Windows crash tied to printing with a screen reader running, plus a macOS fix for files dragged from other apps that wouldn't drop.
Keep in mind that Zen releases constantly. This 1.23.x line alone has been a sprint: 1.23b brought the Library hub, 1.23.1b tacked on Firefox 157.0.1 and a quick-open shortcut, and 1.23.3b jumped to Firefox 158.0. You're now on 158.0.1 with Focus bolted onto Boosts.
It's worth asking whether a small community team can hold this cadence forever, though. Zen keeps pace with Mozilla's security-release machine, but maintaining that velocity without a payroll is an open question nobody's fully answered.
If you're running Zen, update now. The eMudhra fix is active, and baking it into the binary means you're protected regardless of network policy.
Head here to the Zen Browser GitHub releases page to grab 1.23.4b directly, or just check for the update inside the browser itself.
