brave-browser

Brave Browser This repository is not needed for building the browser and only holds issues, releases and the wiki. The source code and contributions are at https://github.com/brave/brave-core. You can visit our website to get the latest stable release. Resources Issues: Bug reports and feature...

CVE-2026-48202

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brave: from n/a through 0.8.8...

CVE-2026-48202 WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brave: from n/a through 0.8.8...

CVE-2026-48202

The WordPress Brave plugin (brave-popup-builder) versions up to and including 0.8.8 is vulnerable to an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability. This flaw allows for Code Injection due to insufficient sanitization of input. No specific exploit l...

EUVD-2026-112915

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brave: from n/a through 0.8.8...

WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability

Content Injection vulnerability discovered by Peter Tang in WordPress Plugin Brave versions = 0.8.8...

WordPress Brave cross-site scripting vulnerability

WordPress Brave versions 0.8.8 and earlier contain a cross-site scripting vulnerability. This flaw stems from improper handling of script-related HTML tags within web pages, making them susceptible to basic cross-site scripting attacks that could lead to code injection...

CVE-2026-59323

A flaw was found in Micrometer Tracing's Brave bridge when using W3C baggage propagation. A remote attacker can exploit this by sending specially crafted requests with excessively large baggage headers. This can lead to unbounded memory allocation, causing high CPU usage, increased garbage...

brave-browser v1.98.12

Brave Browser This repository is not needed for building the browser and only holds issues, releases and the wiki. The source code and contributions are at https://github.com/brave/brave-core. You can visit our website to get the latest stable release. Resources Issues: Bug reports and feature...

Brave Desktop 1.95.101 Security Fixes

Fixed wallet permission list being shown only after page refresh. Upgraded Chromium to 153.0.8010.37 — refer to Google Chrome advisories for inherited CVEs...

Brave Android 1.95.101 Security Fixes

Fix "brave://" URLs opening from external sources as reported on HackerOne by stoletheminerals. Upgraded Chromium to 153.0.8010.37 — refer to Google Chrome advisories for inherited CVEs...

Denial-Of-Service (DoS)

io.micrometer, micrometer-tracing-bridge-brave is vulnerable to a denial-of-service DoS. The vulnerability is due to improper handling of incoming baggage headers, which allows an attacker to send specially crafted or excessive baggage data that causes unbounded object allocation, potentially...

brave-browser v1.97.8

Brave Browser This repository is not needed for building the browser and only holds issues, releases and the wiki. The source code and contributions are at https://github.com/brave/brave-core. You can visit our website to get the latest stable release. Resources Issues: Bug reports and feature...

Malicious code in d3-brave-math (npm)

The package d3-brave-math was found to contain malicious code. --- Credit: OpenSSF source...

CVE-2026-81571

The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side...

CVE-2026-81571 Brave Popup Builder < 0.8.8 - Unauthenticated Arbitrary Shortcode Execution via UTM Parameter

The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side...

EUVD-2026-70044

The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side...

CVE-2026-81571 Brave Popup Builder < 0.8.8 - Unauthenticated Arbitrary Shortcode Execution via UTM Parameter

The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side...

CVE-2026-81571

The Brave WordPress plugin versions prior to 0.8.8 fail to sanitize a URL parameter (UTM) used to pre-fill a form field before passing it to WordPress's shortcode engine . This allows unauthenticated attackers to trigger execution of any shortcode registered on the target site, resulting in serve...

PT-2026-84747

The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side...