Brave
32 CVEs across 10 Brave products. Browse Brave vulnerabilities, severities, and proof-of-concept exploits.
Brave products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-68508 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in Brave Brave brave-popup-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-48980 | Medium | 6.5 | 2025-10-31 | In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item did not respect th… |
CVE-2025-7710 | Critical | 9.8 | 2025-08-02 | The Brave Conversion Engine (PRO) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 0.7.7. This is due to the p… |
CVE-2025-23086 | Medium | 6.1 | 2025-01-21 | On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site… |
CVE-2024-37406 | High | 7.5 | 2024-09-18 | In Brave Android prior to v1.67.116, domains in the Brave Shields popup are elided from the right instead of the left, which may lead to domain confusion. |
CVE-2024-43337 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.7.0. |
CVE-2024-35655 | Medium | 5.9 | 2024-06-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brave Brave brave-popup-builder allows DOM-Based XSS.This… |
CVE-2024-30453 | Medium | 5.4 | 2024-03-29 | Server-Side Request Forgery (SSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.6.5. |
CVE-2023-51534 | Medium | 5.9 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brave Brave – Create Popup, Optins, Lead Generation, Surv… |
CVE-2023-52263 | Medium | 6.1 | 2023-12-30 | Brave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and redirect. This is related to browser/brave_content_browser_client.cc a… |
CVE-2023-28364 | Medium | 6.1 | 2023-07-01 | An Open Redirect vulnerability exists prior to version 1.52.117, where the built-in QR scanner in Brave Browser Android navigated to scanned URLs automatically… |
CVE-2023-28360 | Medium | 4.3 | 2023-05-11 | An omission of security-relevant information vulnerability exists in Brave desktop prior to version 1.48.171 when a user was saving a file there was no downloa… |
CVE-2023-22798 | Medium | 6.1 | 2023-02-09 | Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect interceptors on some websites like Facebook i… |
CVE-2022-47934 | Medium | 6.5 | 2022-12-24 | Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file that mentions an ipfs… |
CVE-2022-47933 | Medium | 6.5 | 2022-12-24 | Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme. This vulnerability… |
CVE-2022-47932 | Medium | 6.5 | 2022-12-24 | Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This vulne… |
CVE-2022-30334 | Medium | 5.3 | 2022-05-07 | Brave before 1.34, when a Private Window with Tor Connectivity is used, leaks .onion URLs in Referer and Origin headers. NOTE: although this was fixed by Brave… |
CVE-2021-45884 | High | 7.5 | 2021-12-27 | In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requ… |
CVE-2021-22929 | Medium | 6.1 | 2021-08-31 | An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2… |
CVE-2021-22917 | Medium | 6.5 | 2021-07-12 | Brave Browser Desktop between versions 1.17 and 1.20 is vulnerable to information disclosure by way of DNS requests in Tor windows not flowing through Tor if a… |
CVE-2021-22916 | Medium | 5.9 | 2021-07-12 | In Brave Desktop between versions 1.17 and 1.26.60, when adblocking is enabled and a proxy browser extension is installed, the CNAME adblocking feature issues… |
CVE-2021-21323 | Medium | 4.3 | 2021-02-23 | Brave is an open source web browser with a focus on privacy and security. In Brave versions 1.17.73-1.20.103, the CNAME adblocking feature added in Brave 1.17… |
CVE-2020-8276 | Medium | 5.5 | 2020-11-09 | The implementation of Brave Desktop's privacy-preserving analytics system (P3A) between 1.1 and 1.18.35 logged the timestamp of when the user last opened an in… |
CVE-2018-1000815 | Medium | 4.3 | 2018-12-20 | Brave Software Inc. Brave version version 0.22.810 to 0.24.0 contains a Other/Unknown vulnerability in function ContentSettingsObserver::AllowScript() in conte… |
CVE-2018-10799 | Medium | 6.5 | 2018-05-08 | A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux). This vulnerability is caused by the mishandling of a long URL formed by window.loc… |
CVE-2018-10798 | Medium | 6.5 | 2018-05-08 | A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux). The vulnerability is caused by mishandling of JavaScript code that triggers the re… |
CVE-2017-18256 | Medium | 6.5 | 2018-04-04 | Brave Browser before 0.13.0 allows remote attackers to cause a denial of service (resource consumption) via a long alert() argument in JavaScript code, because… |
CVE-2016-10718 | High | 7.5 | 2018-04-04 | Brave Browser before 0.13.0 allows a tab to close itself even if the tab was not opened by a script, resulting in denial of service. |
CVE-2017-1000461 | Medium | 4.7 | 2018-01-03 | Brave Software's Brave Browser, version 0.19.73 (and earlier) is vulnerable to an incorrect access control issue in the "JS fingerprinting blocking" component… |
CVE-2017-8459 | Medium | 5.3 | 2017-05-03 | Brave 0.12.4 has a Status Bar Obfuscation issue in which a redirection target is shown in a possibly unexpected way. NOTE: third parties dispute this issue bec… |
CVE-2017-8458 | Medium | 6.5 | 2017-05-03 | Brave 0.12.4 has a URI Obfuscation issue in which a string such as https://safe.example.com@unsafe.example.com/ is displayed without a clear UI indication that… |
CVE-2016-9473 | Medium | 4.7 | 2017-03-28 | Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier suffer from Full Address Bar Spoofing, allowing attackers to trick a victim by dis… |