Zen is a desktop browser built on Firefox that rethinks the layout rather than the engine. Tabs live in a vertical sidebar, grouped into workspaces you switch between for work, personal browsing or a project, with essentials pinned at the top. Split view puts two or more pages side by side, compact mode hides the toolbars until you need them, and Glance opens a link in a floating preview so you can read it without leaving the page you were on.
Because it is Firefox underneath, your Firefox extensions, the Gecko engine and its tracking protection all carry over, and the release build tracks current Firefox (158.0 when scanned). Zen Mods let you restyle the interface with community themes. It is one of the few independent browsers that is not another Chromium fork.
It is MPL-2.0, at about 45,300 stars with 271 contributors, and moves quickly: release 1.23.4b when scanned, plus a nightly Twilight channel. Fast releases mean occasional rough edges, and it is desktop only, with no phone app.
- Repository: github.com/zen-browser/desktop
- Licence: MPL-2.0 (Mozilla Public License 2.0)
- Language: C++. Stars: 45.3K. Forks: 1,904. Last push: Oct 26, 2026.
- Scan: safe, Oct 26, 2026, commit 9b604fe
Who it is for
People who keep dozens of tabs open, like Arc's sidebar and workspaces but want Firefox's engine and extensions, and anyone who would rather not use another Chromium browser.
Getting started
1. macOS (Homebrew)
brew install --cask zen2. Linux (Flathub)
flatpak install flathub app.zen_browser.zen3. Windows and other downloads
open https://zen-browser.app/downloadOn first run Zen offers to import bookmarks, history and passwords from your current browser. The Twilight build on the same download page tracks the newest changes and is less stable.
Safety scan
We cloned zen-browser/desktop at commit 9b604fe on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no install hooks and no bare-IP URLs. The two pattern hits are very long lines in a Mozilla test file under src/zen/tests/mochitests, serialized security policies used as fixtures.
- The one committed binary, build/windows/mar.exe, is Mozilla's MAR tool for packaging and signing Firefox-style update files, used by the Windows build.
- The scanner's host list is dominated by Firefox's own source references (searchfox.org, mozilla.org, bugzilla) and test domains; nothing points at an unexpected server.
- The 8 known advisories are in the build scripts' package-lock.json (sharp, follow-redirects, yaml, babel) and one unmaintained Rust crate in a prefs tool. None of them ships inside the browser.
- 15 workflows, none using pull_request_target. Three have write-all permissions (build, clear-all-cache and the Twilight schedule), and all three run only on a schedule or by a maintainer's hand. None of the 29 third-party actions is pinned to a commit. Security policy, licence and code of conduct present; no Dependabot or CodeQL.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 2 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | 1 executable or compiled object committed; listed under the raw findings. |
| CI workflows | 15 workflows. None use pull_request_target. 3 grant write-all permissions. 29 of 29 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often searchfox.org, creativecommons.org, mozilla.org, json.nlohmann.me. No URLs to bare IP addresses. |
| Known vulnerabilities | 8 advisories across 337 pinned packages: 0 critical, 5 high, 1 moderate, 1 low, 1 unrated. package-lock.json: 327 packages, 7 advisories; requirements.txt: 7 packages, 0 advisories; tools/ffprefs/Cargo.lock: 14 packages, 1 advisories. |
| Project hygiene | Has security policy, licence file. Missing automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (2)
| Where | Rule | Match |
|---|---|---|
| src/zen/tests/mochitests/caps/browser_principalSerialization_csp.js:47 | very-long-line | 4527 chars |
| src/zen/tests/mochitests/caps/browser_principalSerialization_csp.js:64 | very-long-line | 4571 chars |
Committed binaries (1)
build/windows/mar.exe: PE (Windows executable), 203 KB
Worst known vulnerabilities (8 of 8)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-8r9p-f939-6h3c | high | follow-redirects@1.16.0 | follow-redirects sensitiveHeaders regex escaping can expose credential headers |
| GHSA-q3jh-wrc6-jgq8 | high | follow-redirects@1.16.0 | follow-redirects array-form headers bypass cross-origin credential stripping |
| GHSA-f88m-g3jw-g9cj | high | sharp@0.32.6 | sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 |
| GHSA-rgj7-g3m4-5g8c | high | sharp@0.32.6 | sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 |
| GHSA-wq5f-xc86-pv6w | high | sharp@0.32.6 | sharp : Vulnerability in librsvg dependency CVE-2026-96889 |
| GHSA-48c2-rrv3-qjmp | moderate | yaml@2.7.0 | yaml is vulnerable to Stack Overflow via deeply nested YAML collections |
| GHSA-4x5r-pxfx-6jf8 | low | @babel/core@7.26.10 | @babel/core: Arbitrary File Read via sourceMappingURL Comment |
| RUSTSEC-2024-0449 | unknown | unsafe-libyaml@0.2.11 | unsafe-libyaml is unmaintained |
Workflows worth a look
- .github/workflows/build.yml: permissions: write-all
- .github/workflows/clear-all-cache.yml: permissions: write-all
- .github/workflows/twilight-release-schedule.yml: permissions: write-all
By the numbers
| Stars | 45.3K |
|---|---|
| Forks | 1,904 |
| Contributors | 271 |
| Commits | 7,154 |
| Open issues | 737 |
| Open pull requests | 77 |
| Releases | 196 |
| Latest release | 1.23.4b |
| Licence | MPL-2.0 |
| Main language | C++ |
| Project age | 2 years |
| Last push | Oct 26, 2026 |
| Tracked files | 2,626 |
| Lines of code | 334.2K |
| Checkout size | 42 MB |
Lines by language: JavaScript 184.1K, TypeScript 79.8K, C/C++ header 26.3K, CSS 14.2K, Markdown 7,366, Python 6,863.
Questions
Is Zen Browser free?
Yes. Zen is free and open source under the Mozilla Public License 2.0, with no account, subscription or paid tier. The project is funded by donations and partners.
Does Zen Browser work with Firefox extensions?
Yes. Zen is built on Firefox, so it installs add-ons from addons.mozilla.org and uses the same Gecko engine, which means sites behave as they do in Firefox.
Is Zen Browser like Arc?
In layout, yes: vertical tabs in a sidebar, workspaces, pinned essentials and split view. The difference is the engine. Arc is built on Chromium, while Zen is built on Firefox and is open source.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.