WS-2023-0183

Brave iOS has two weaknesses described below. By combining them, XSS can be achieved on the privileged origin internal://local. First issue - Exposure of uuidKey through REFERER header Reader mode in Brave has two HTML templates, Reader.html and ReaderViewLoading.html. The former template defines...

Brave Software: New XSS vector in ReaderMode with %READER-TITLE-NONCE%

A new XSS vulnerability was discovered in Brave iOS 1.31.1 and higher, which allowed attackers to execute malicious scripts on ReaderMode pages. The vulnerability was caused by a relaxation of the CSP rule, which allowed scripts with nonce-%READER-TITLE-NONCE% to be executed. Attackers could...