686 matches found
PT-2022-20068 · Brave · Brave
Name of the Vulnerable Software and Affected Versions: Brave versions prior to 1.34 Description: The issue occurs when a Private Window with Tor Connectivity is used, causing .onion URLs to leak in Referer and Origin headers. Although this was fixed by Brave, the Brave documentation notes that...
Brave 信息泄露漏洞
Brave is a fast, private and secure web browser from Brave USA. A security vulnerability exists in Brave versions prior to 1.34 that stems from leaks.onion URLs appearing in the headers of Referer and Origin when using a private window with a Tor connection...
Google Releases Urgent Chrome Update to Patch Actively Exploited Zero-Day Flaw
Google on Thursday shipped emergency patches to address two security issues in its Chrome web browser, one of which it says is being actively exploited in the wild. Tracked as CVE-2022-1364, the tech giant described the high-severity bug as a case of type confusion in the V8 JavaScript engine...
A week in security (March 7 – March 13)
Last week on Malwarebytes Labs: The struggle to reduce bug-fixing time is real Update now! Mozilla patches two actively exploited vulnerabilities Google takes on Docs notification spammers When fake dating profiles try the military approach Azure AutoWarp brings automation headaches RagnarLocker...
Brave browser goes the extra mile to block third party cookies
Brave is testing a new feature to stop bounce tracking, a sneaky method that websites use to load third-party tracking cookies so they can gather more information about who is visiting their site. The Brave browser As you may remember from our post about the best browsers for privacy and security...
Brave Software: XSS on internal: privileged origin through reader mode
A vulnerability in Brave iOS versions 1.32.3 and higher allowed for XSS attacks on the privileged origin internal://local through the combination of two weaknesses. The first weakness was the exposure of uuidKey through the REFERER header due to the lack of referrer header protection in the...
CVE-2021-45884
In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requests are issued outside of the proxying extension using the system's DNS settings, resulting in information disclosure. NOTE: this issue...
CVE-2021-45884
In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requests are issued outside of the proxying extension using the system's DNS settings, resulting in information disclosure. NOTE: this issue...
CVE-2021-45884
In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requests are issued outside of the proxying extension using the system's DNS settings, resulting in information disclosure. NOTE: this issue...
Design/Logic Flaw
In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requests are issued outside of the proxying extension using the system's DNS settings, resulting in information disclosure. NOTE: this issue...
CVE-2021-45884
Brave Desktop versions 1.17–1.33.x prior to 1.33.106 are affected. When CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, DNS requests are issued outside the proxying extension using the system DNS settings, leading to information disclosure. Root cause described ...
CVE-2021-45884
In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requests are issued outside of the proxying extension using the system's DNS settings, resulting in information disclosure. NOTE: this issue...
Brave Software: Universal XSS with Playlist feature
A Universal XSS vulnerability was discovered in Brave iOS versions 1.32.3 and higher. The vulnerability was caused by three weaknesses, including the exposure of UserScriptManager.securityToken and UserScriptManager.messageHandlerToken, as well as a UXSS vulnerability in PlaylistHelper through...
Brave 信息泄露漏洞
Brave is a fast, private and secure web browser from Brave USA. Brave Desktop suffers from an information disclosure vulnerability that originates in Brave Desktop 1.17 through 1.33 prior to 1.33.106, when cname-based adblocking and proxy extensions with SOCKS fallback are enabled, that uses the...
Brave Software: New XSS vector in ReaderMode with %READER-TITLE-NONCE%
A new XSS vulnerability was discovered in Brave iOS 1.31.1 and higher, which allowed attackers to execute malicious scripts on ReaderMode pages. The vulnerability was caused by a relaxation of the CSP rule, which allowed scripts with nonce-%READER-TITLE-NONCE% to be executed. Attackers could...
Brave Android 1.31.91 Security Fixes
Clarified sync setup instructions...
Brave Software: Information disclosure
Vulnerability tested on:- Brave 1.29.81 Chromium: 93.0.4577.82 Official Build 64-bit Vulnerability description:- For security measures and for privacy purposes, Brave has the ability to open a normal tab of the Brave when we navigate to: chrome://wallet, chrome://history etc. due to the reason th...
Brave Software: Information disclosure-Referer leak
Assigned to: Brave Assigned by: Kirtikumar Anandrao Ramchandani Assigned on: 13/09/2021 Browser information used to test Up to date: Brave 1.29.79 Chromium: 93.0.4577.63 Official Build 64-bit Revision ff5c0da2ec0adeaed5550e6c7e98417dac77d98a-refs/branch-heads/4577@1135 OS Windows 10 OS Version 20...
Brave has unspecified vulnerabilities
Brave is a fast, private and secure web browser from Brave, Inc. Brave Browser Desktop 1.28.62 and earlier versions have a security vulnerability that could be exploited by attackers to obtain "V2 onion domains"...