CVE-2017-1000461

Brave Software's Brave Browser, version 0.19.73 and earlier is vulnerable to an incorrect access control issue in the "JS fingerprinting blocking" component, resulting in a malicious website being able to access the fingerprinting-associated browser functionality that the browser intends to block...

Brave Desktop 1.78.94 Security Fixes

Re-encoded images fetched for Brave News. Upgraded Chromium to 136.0.7103.60 — refer to Google Chrome advisories for inherited CVEs...

Brave Software: Prompt Injection via GitHub Patch in Brave AI Chat (Leo)

Component: Brave AI Chat brave-core/components/aichat/ Severity: High Confirmed ability to override AI instructions and persona via fetched content Vulnerability Summary The Brave AI Chat feature allows fetching .patch files from GitHub pull request pages to use as context. A combination of...

Brave Android 1.77.95 Security Fixes

Updated brave://downloads to always display the download URL as reported on HackerOne by cj27. Upgraded Chromium to 135.0.7049.52 — refer to Google Chrome advisories for inherited CVEs...

Brave Desktop 1.77.95 Security Fixes

Updated brave://downloads to always display the download URL as reported on HackerOne by cj27. - Prevent extensions from injecting content scripts on https://account.brave.com as reported on HackerOne by newfunction. Upgraded Chromium to 135.0.7049.52 — refer to Google Chrome advisories for...

Brave Desktop 1.76.73 Security Fixes

Fixed Tor leaks as reported on HackerOne by 0x999. 44299, 44333, & 44334 Upgraded Chromium to 134.0.6998.45 — refer to Google Chrome advisories for inherited CVEs...

Brave Desktop 1.75.175 Security Fixes

Fixed issue where audio was not being farbled in certain cases as reported on HackerOne by cesiumfusilli. - Disabled block element picker in Private Windows as reported on HackerOne by newfunction. Upgraded Chromium to 133.0.6943.54 — refer to Google Chrome advisories for inherited CVEs...

Brave Android 1.75.175 Security Fixes

Fixed issue where audio was not being farbled in certain cases as reported on HackerOne by cesiumfusilli. Upgraded Chromium to 133.0.6943.54 — refer to Google Chrome advisories for inherited CVEs...

Brave Desktop Browser Vulnerability Lets Malicious Sites Appear Trusted

A critical vulnerability in Brave Browser allows malicious websites to appear as trusted sources during file uploads/downloads. Learn…...

Brave Software: Null Pointer Dereference by Crafted Response from AI Model

The Brave browser was affected by a null pointer dereference vulnerability caused by a crafted response from an AI model. The vulnerability was triggered when the user set a malicious endpoint as the AI model's server endpoint. The code handling the server response assumed a specific structure...

CVE-2025-23086

On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site prompts the user to upload or download a file. However the origin was not correctly inferred in some cases. When combined with an open...

CVE-2025-23086

On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site prompts the user to upload or download a file. However the origin was not correctly inferred in some cases. When combined with an open...

CVE-2025-23086

Brave Browser versions 1.70.x through 1.73.x on most desktop platforms contain an input validation error where the site's origin is not correctly inferred in the OS-provided file selector dialog. This occurs when a site prompts for a file upload or download. If combined with an open redirector on...

CVE-2025-23086

On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site prompts the user to upload or download a file. However the origin was not correctly inferred in some cases. When combined with an open...

Brave Browser 输入验证错误漏洞

Brave Browser is a fast, private and secure web browser for PC, Mac and mobile devices from Brave, Inc. An input validation error vulnerability exists in Brave Browser versions 1.70.x through 1.73.x. The vulnerability stems from the source of a site not being correctly identified in the file...

PT-2025-4816 · Brave · Brave Browser

Name of the Vulnerable Software and Affected Versions: Brave Browser versions 1.70.x through 1.73.x Description: The issue arises from a feature that displays a site's origin on the OS-provided file selector dialog when a site prompts the user to upload or download a file. However, the origin is...

Brave Desktop 1.74.48 Security Fixes

Fixed iframe download popup origin confusion as reported on HackerOne by syarif07. Upgraded Chromium to 132.0.6834.83 — refer to Google Chrome advisories for inherited CVEs...

Brave Desktop 1.73.105 Security Fixes

Fixed race condition which caused a crash in Brave Wallet as reported on HackerOne by renwa. Upgraded Chromium to 131.0.6778.265 — refer to Google Chrome advisories for inherited CVEs...

Brave Android 1.73.105 Security Fixes

Fixed race condition which caused a crash in Brave Wallet as reported on HackerOne by renwa. Upgraded Chromium to 131.0.6778.265 — refer to Google Chrome advisories for inherited CVEs...

PT-2025-1005

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 131.0.6778.264 Microsoft Edge versions prior to 131.0.6778.264 Brave versions prior to 131.0.6778.264 Description: The issue is related to a type confusion problem in the V8 engine of Google Chrome, which allow...