WS-2023-0185

New XSS vector in brave-ios in ReaderMode with %READER-TITLE-NONCE%: A relaxation of a CSP rule can be exploited for XSS attacks on ReaderMode pages. As a result, any cross-origin pages, that has been converted to ReaderMode, can be stolen and an attacker can gain access to Brave's privileged pag...