What is CVE-2025-48980?

CVE-2025-48980 is a medium-severity vulnerability in Brave Desktop Browser, classified under Reliance on Cookies without Validation and Integrity Checking. CVSS score: 6.5/10. Published 2025-10-31.

How severe is CVE-2025-48980?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Brave Desktop Browser

CVE-2025-48980

In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item did not respect the SameSite cookie attribute. Therefore SameSite=Strict cookies would be sent on a cross-site navigation using this method.

EPSS: 0.003 (22.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.

Affected products

Brave Desktop Browser — versions 1.83.10

Weakness classification (CWE)

CWE-565 — Reliance on Cookies without Validation and Integrity Checking

References

support@hackerone.com

Frequently asked questions

What is CVE-2025-48980?: CVE-2025-48980 is a medium-severity vulnerability in Brave Desktop Browser, classified under Reliance on Cookies without Validation and Integrity Checking. CVSS score: 6.5/10. Published 2025-10-31.
How severe is CVE-2025-48980?: Medium severity. CVSS v3 base score is 6.5 out of 10.