Design/Logic Flaw

Brave 0.12.4 has a URI Obfuscation issue in which a string such as https://email protected/ is displayed without a clear UI indication that it is not a resource on the safe.example.com web site...

CVE-2017-8458

Brave 0.12.4 has a URI Obfuscation issue in which a string such as https://[email protected]/ is displayed without a clear UI indication that it is not a resource on the safe.example.com web site...

CVE-2017-8459

The CVE-2017-8459 entry concerns Brave 0.12.4 with a Status Bar Obfuscation flaw where a redirection target may appear in an unexpected way. CNVD-2017-06047 explicitly notes that an attacker could redirect users to malicious websites, leading to disclosure of personal information or property dama...

CVE-2017-8459

Brave 0.12.4 has a Status Bar Obfuscation issue in which a redirection target is shown in a possibly unexpected way. NOTE: third parties dispute this issue because it is a behavior that might have legitimate applications in for example the display of web-search results...

CVE-2017-8459

Brave 0.12.4 has a Status Bar Obfuscation issue in which a redirection target is shown in a possibly unexpected way. NOTE: third parties dispute this issue because it is a behavior that might have legitimate applications in for example the display of web-search results...

CVE-2017-8458

Brave 0.12.4 has a URI obfuscation vulnerability where a URL like https://[email protected]/ can be displayed without a clear indication it’s not under safe.example.com. Multiple sources (CNVD-2017-06046, NVD duplicate, CNVD entry) describe this as a Brave browser issue allowing...

CVE-2017-8458

Brave 0.12.4 has a URI Obfuscation issue in which a string such as https://[email protected]/ is displayed without a clear UI indication that it is not a resource on the safe.example.com web site...

PT-2017-18349 · Brave · Brave

Name of the Vulnerable Software and Affected Versions: Brave version 0.12.4 Description: The issue concerns a Status Bar Obfuscation problem where a redirection target is displayed in a potentially unexpected manner. This behavior might have legitimate uses, such as in the display of web-search...

Brave Software: homograph-attack (unicode vuln)

Hi team Summary: Affacted product appears identicaly different websites domains attacker uses unicode to register domains that look identical to real domains ,These fake domains can be used to fool users into signing into a fake website, thereby handing over their login credentials to an...

Brave Browser: Fast AdBlocker - Dangerous filesystem permissions, Exported ContentProvider, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Brave Browser: Fast AdBlocker published at the 'play' market has multiple vulnerabilities...

Brave Browser iOS and Brave Browser Android Address Bar Spoofing Vulnerability

Brave Browser iOS and Brave Browser Android are both web browsers from Brave Software, USA. The former is for iOS; the latter is for Android. A security vulnerability exists in Brave Browser iOS versions prior to 1.2.18 and Brave Browser Android versions 1.9.56 and earlier. An attacker can exploi...

CVE-2016-9473

Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier suffer from Full Address Bar Spoofing, allowing attackers to trick a victim by displaying a malicious page for legitimate domain names...

CVE-2016-9473

Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier suffer from Full Address Bar Spoofing, allowing attackers to trick a victim by displaying a malicious page for legitimate domain names...

Design/Logic Flaw

Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier suffer from Full Address Bar Spoofing, allowing attackers to trick a victim by displaying a malicious page for legitimate domain names...

CVE-2016-9473

CVE-2016-9473 affects Brave Browser on iOS (before 1.2.18) and Android (before 1.9.56). The vulnerability is described as a Full Address Bar Spoofing issue that allows an attacker to display a malicious page for legitimate domain names, potentially misleading users about the site they’re viewing....

CVE-2016-9473

Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier suffer from Full Address Bar Spoofing, allowing attackers to trick a victim by displaying a malicious page for legitimate domain names...

Brave Software: [iOS] URL can be replaceState by blob URL in iOS Brave

Summary: URL can be replace by blob URL using function history.replaceState Products affected: iOS brave version 1.3.117.02.14.11 Steps To Reproduce: - Add a html named "blob.html" which link is "http://192.168.1.111/blob.html" - And its source is:...

Brave Software: Address bar spoofing in Brave browser via. window close warnings

Hello, I would like to Report Address Bar spoofing vulnerability in Brave Browser on macOS. Summary: When people visit the poc page,I notice them to type a DNS record exist but cannot access domain "access.apple.com" to address bar.then window will popup a close warnings,then phishing is...

Brave Software: Brave payments remembers history even after clearing all browser data.

NOTE! Thanks for submitting a report! Please fill all sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty. Summary: As a user you expect the browser to not persist data after clearing browser data...

Brave Software: No user confirmation when an auto-updated extension gets more permissions

Summary: In Chrome, when extensions are auto-updated, if the permissions change, the extension is preventatively disabled and the user has to confirm they wish to re-enable it with the additional permissions. While it appears Brave has a functioning Extension auto-updater e.g. for the PDF...