Zen Browser 1.24.1b ships a security patch just as rival Arc heads for the exit
The Firefox fork closes a CVSS 8.8 vulnerability and adds a grain filter, landing the week its most direct competitor announced its death.
Zen Browser 1.24.1b is out, and it closes a genuinely serious hole. The patch dropped today, it rides the 1.24b line from late October, and it lands in the exact window when its most direct rival is being shut down. Call it convenient timing.
What actually changed
The piece that matters is security. Zen's patch bumps the underlying engine to Firefox 159.0.1, folding in Mozilla advisory MFSA 2026-123, which fixes CVE-2026-120572. Mozilla calls it High, and an independent aggregator, NotCVE, scores it 8.8 on CVSS.
The flaw sits in the layout engine, the part of Gecko that arranges content on a page, and it's a memory-buffer boundary problem. An attacker needs you to open a specially crafted web page, so it's remote but demands a little social engineering. HKCERT describes the practical payoff as denial of service. No proof-of-concept is out there yet, and there's no workaround, so updating is the only fix.
Zen shut that window within days of Mozilla's 3 November advisory. For a small team that rebases on Firefox's channels, that cadence is genuinely impressive.
The rest of the patch is lighter. There's one real feature: grain options in the theme picker. Click the circle inside the theme dial to cycle through subtle texture effects. It won't change your life, but it's a fine knob for people who already enjoy dressing up their browser.
The fixes are where the patch earns its keep. On Windows, a command prompt window used to flash whenever Zen restarted to apply an update, and passkey sign-in was broken on related sites, with Facebook and Instagram named as broken cases. Then there are two graphics-specific fixes: Windows crashes tied to certain antivirus programs (which could also strip WebGL out), plus swapped red-and-blue colors on WebGL under Linux, which broke video-call background blur. On macOS, the UI now leans into Apple's SF Symbols.
Keep in mind that Zen marks its builds with a trailing "b" (1.24b, 1.24.1b) and markets them as "Zen Stable Release"s. The ".1" just flags a patch on the 1.24 line, distinct from the feature-heavy 1.24b base. Behind the scenes, this build sits on base commit 12c01ff1e7b307e78f641b2a1531ca6f229c6286, published around 19:03 UTC.
The timing that matters
Here's the part reporters will zoom in on. Zen 1.24b, launched in late October, added direct import of Spaces and Profiles from Arc and its successor, Dia. Now The Browser Company has said it's killing Arc on 22 December 2026.
New accounts stopped opening immediately. macOS and Windows builds will stop working entirely on that date, accounts get deactivated, and personal data is deleted within roughly 30 days. The company is folding its effort into Dia, an AI-first browser built on Arc's own proprietary development kit.
Zen is the natural landing zone for people who liked Arc's layout but didn't want to mortgage their data to a proprietary successor. It runs on Gecko, it's licensed under the Mozilla Public License 2.0, and it takes standard Firefox add-ons. ZDNet called it "the customizable Firefox I've been waiting for." The Register liked its no-Google power-user bent, and XDA's Adam Conway compared it to a cross between Floorp, Vivaldi, Firefox, and Chrome.
It's a strong pitch, though not a clean one. Zen deliberately ships without Google code, which is exactly why uBlock Origin runs unrestricted. That same choice means no licensed Widevine module, so Netflix, Disney+, Prime Video, and Apple Music won't play on Windows and macOS. That remains the "only major downside" reviewers keep circling back to.
For what it's worth, the install base already shows up in the numbers. Windows is the dominant platform: the update payload alone was pulled over 5,000 times shortly after release, with macOS a solid second. Zen also ships ARM64 builds for Windows and Linux, plus a 1.08 GB source tarball, which points to a crowd that spans everyday desktop users, developers, and early adopters on new hardware.
The one thing the team has been blunt about: there are no mobile versions coming. Resources are thin, and the small group around creator Mauro V. wants to keep this a desktop tool. Honest constraint, if not an ambitious one.
If you're running an older Zen build, you were exposed. Update today. Head here to grab the installer for your platform.
