HexBrain
Sign in

Browse / Brave Software

Brave Software

117disclosed reports

See its reports on the map

What gets reported to Brave Software

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Brave Browser Tor Window leaks user's real IP to the external DNS serverInformation Disclosure · high
    280 votes
  2. Open redirect due to scanning QR code via brave browserOpen Redirect · high
    148 votes
  3. Stored XSS in localhost:* via integrated torrent downloaderCross-site Scripting (XSS) - Stored · medium
    124 votes
  4. Null Pointer Dereference by Crafted Response from AI ModelNULL Pointer Dereference · low
    116 votes
  5. Incorrect security UI of files' download source on brave MacOSUser Interface (UI) Misrepresentation of Critical Information · high
    87 votes
  6. Cookie steal through content UriWeak Password Recovery Mechanism for Forgotten Password · critical
    79 votes
  7. Prompt Injection via GitHub Patch in Brave AI Chat (Leo)InformativeLLM01: Prompt Injection · high
    77 votes
  8. Local files reading from the web using `brave://`Path Traversal · critical
    74 votes
  9. SameSite restrictions are lifted, and SameSite:Strict cookie are being sent.Improper Certificate Validation · high
    73 votes
  10. New XSS vector in ReaderMode with %READER-TITLE-NONCE%Cross-site Scripting (XSS) - Generic · critical
    72 votes
  11. UXss on brave browser via scan QR CodeCross-site Scripting (XSS) - Generic · high
    68 votes
  12. Sending arbitrary IPC messages via overriding Function.prototype.applyCommand Injection - Generic · critical
    53 votes
  13. Brave Shields Domain Reordering Leads to Origin ConfusionViolation of Secure Design Principles · low
    52 votes
  14. Lack of quarantine meta-attribute for downloaded files leads to GateKeeper bypassViolation of Secure Design Principles · low
    52 votes
  15. DNS Leaks when using any VPN Browser extension with Brave Shield enabledInformation Disclosure · high
    51 votes
  16. iOS Brave Playlist "Open in Private Tab" bypasses FaceID requirement for Private TabsImproper Authentication - Generic · medium
    49 votes
  17. `chrome://brave` available for navigation in Release build [-> RCE] + navigation to `chrome://*` using tab_helper ["Open in new tab"]Code Injection · high
    46 votes
  18. Brave Android: Incorrect URL Eliding in Brave Shields Pop UpViolation of Secure Design Principles · low
    45 votes
  19. Local files reading using `link[rel="import"]`Path Traversal · high
    43 votes
  20. [Android] HTML Injection in BatterySaveArticleRenderer WebViewCross-site Scripting (XSS) - Generic · high
    43 votes
  21. Information disclosure-Referer leakInformation Disclosure · high
    42 votes
  22. Browser is not following proper flow for redirection cause open redirect Open Redirect · high
    41 votes
  23. Onion-Location header allows to open arbitrary URLs including chrome:Violation of Secure Design Principles · high
    40 votes
  24. UAF on JSEthereumProviderUse After Free · critical
    38 votes
  25. download file type warning on Windows does not appear if "ask where to save file before downloading" setting is enabledhigh
    31 votes
  26. HTML injection in title of reader viewCross-site Scripting (XSS) - DOM · medium
    30 votes
  27. [iOS/Android] Address Bar Spoofing Vulnerability Violation of Secure Design Principles
    30 votes
  28. Universal XSS with Playlist featureCross-site Scripting (XSS) - Stored · high
    27 votes
  29. Navigation to protocol handler URL from the opened page displayed as a request from this page.medium
    25 votes
  30. S3 Bucket Takeover "brave-browser-rpm-staging-release-test"Improper Access Control - Generic
    24 votes
  31. XSS on Brave Today through custom RSS feedCross-site Scripting (XSS) - DOM · medium
    24 votes
  32. Local files reading from the "file://" origin through `brave://`Path Traversal · high
    24 votes
  33. Open redirect found on account.brave.comOpen Redirect · medium
    21 votes
  34. chrome://brave navigation from webCode Injection · critical
    21 votes
  35. URL Spoof / Brave Shield BypassUse of Inherently Dangerous Function · high
    21 votes
  36. DMARC RECORD MISSINGMisconfiguration · low
    20 votes
  37. S3 Bucket Takeover : brave-aptImproper Access Control - Generic · medium
    19 votes
  38. Brave Browser permanently timestamps & logs connection times for all v2 domains ~/.config/BraveSoftware/Brave-Browser/tor/data/tor.logCleartext Storage of Sensitive Information · medium
    19 votes
  39. https://publishers.basicattentiontoken.org/favicon.ico is Vulnerable to CVE-2017-7529Array Index Underflow · medium
    18 votes
  40. No rate limiting for confirmation email lead to email flooding and leads to enumeration of emails in publishers.basicattentiontoken.orgViolation of Secure Design Principles · low
    18 votes
  41. Universal XSS through FIDO U2F register from subframeCross-site Scripting (XSS) - Generic · high
    17 votes
  42. Username Information Disclosure via Json response - Using parameter number IntruderInformativeInformation Disclosure · low
    16 votes
  43. RCE: DnDing shortcut files to chrome://brave allows loading HTML files in Muon's contextCode Injection · high
    16 votes
  44. unclaimed s3 bucket takeover in the 3 js file located on the github page of brave softwareInformativeBusiness Logic Errors · low
    15 votes
  45. Arbitrary file download due to bad handling of Redirects in WebTorrentCode Injection · medium
    15 votes
  46. Bypassing Homograph Attack Using /@ [ Tested On Windows ]Violation of Secure Design Principles · low
    15 votes
  47. Homograph Attack Bypass [ Tested on Linux & Windows ]Violation of Secure Design Principles · low
    15 votes
  48. Persistent user tracking is possible using window.caches, by avoiding Brave ShieldsPrivacy Violation · medium
    14 votes
  49. Redirecting users to malicious torrent-files/websites using WebTorrentViolation of Secure Design Principles · medium
    14 votes
  50. URL spoofing in Brave for macOSViolation of Secure Design Principles · medium
    14 votes
  51. Homograph attackViolation of Secure Design Principles · low
    14 votes
  52. [ios] Address bar spoofing in Brave for iOSViolation of Secure Design Principles · low
    13 votes
  53. Access to local file system using javascriptPath Traversal · medium
    13 votes
  54. Brave News feeds can open arbitrary chrome: URLsPrivilege Escalation · high
    12 votes
  55. Security token and handler name leak from window.braveBlockRequestsInformation Disclosure · high
    12 votes
  56. Phishing/Malware site blocking on Brave iOS can be bypassed with trailing dot in hostnameViolation of Secure Design Principles · medium
    12 votes
  57. HTTP Request SmugglingInformativeHTTP Request Smuggling · high
    12 votes
  58. chrome://brave can still be navigated to, leading to RCECode Injection · high
    12 votes
  59. Torrent extension: Cross-origin downloading + "URL spoofing" + CSP-blocked XSSDuplicateCross-site Scripting (XSS) - Generic · medium
    12 votes
  60. Navigation to restricted origins via "Open in new tab"Improper Access Control - Generic · medium
    12 votes
  61. Arbitrary file download via "Save .torrent file" option can lead to Client RCE and XSSCode Injection · medium
    11 votes
  62. Navigation to `chrome-extension://` origin (internal pages) from the weblow
    11 votes
  63. Unsafe handling of protocol handlerslow
    11 votes
  64. Download attribute allows downloading local filesPath Traversal · low
    11 votes
  65. Cross-origin page stays focused before/after downloading + uninformative modal window for downloadlow
    10 votes
  66. application/x-brave-tab should not be readable.Privacy Violation · high
    10 votes
  67. [website] Script injection in newsletter signup https://brave.com/brave_youth_program_signup.htmlCommand Injection - Generic · medium
    10 votes
  68. Brave Shield for iOS is weak against IDN homograph attacksPhishing · low
    9 votes
  69. [Brave browser] WebTorrent has DNS rebinding vulnerabilityInformation Disclosure · low
    9 votes
  70. URL spoofing using protocol handlersViolation of Secure Design Principles · medium
    9 votes
  71. Torrent Viewer extension web service available on all interfacesInformation Disclosure · medium
    9 votes
  72. Brave Browser unexpectedly allows to send arbitrary IPC messagesCommand Injection - Generic · critical
    9 votes
  73. [DOS] Browser hangs on loading the code snippetUncontrolled Resource Consumption · low
    9 votes
  74. Field Day With Protocol Handlersmedium
    8 votes
  75. DoS in Brave browser for iOSUncontrolled Resource Consumption · low
    8 votes
  76. There is vulnebility Click Here TO fixN/AImproper Restriction of Authentication Attempts · medium
    8 votes
  77. Command Execution because of extension handlingDuplicateCommand Injection - Generic · high
    8 votes
  78. Address Bar Spoofing - Already resolved - Retroactive reportOpen Redirect · low
    8 votes
  79. Status Bar ObfuscationCryptographic Issues - Generic · low
    8 votes
  80. XSS on internal: privileged origin through reader modeCross-site Scripting (XSS) - Generic · high
    7 votes
  81. Brave Browser potentially logs the last time a Tor window was usedCleartext Storage of Sensitive Information · low
    7 votes
  82. URI ObfuscationHTTP Response Splitting · medium
    7 votes
  83. Subdomain Takeover of Brave.comDuplicateImproper Authentication - Generic
    7 votes
  84. 2 Directory Listing on ledger.brave.com & vault-staging.brave.comInformation Disclosure · low
    7 votes
  85. `alert()` dialogs on `chrome-extension://` origin (internal pages)Duplicatelow
    6 votes
  86. OS username disclosurePrivacy Violation · low
    6 votes
  87. [iOS] URL can be replaceState by blob URL in iOS BraveViolation of Secure Design Principles · low
    6 votes
  88. Sending arbitrary IPC messages via overriding Array.prototype.pushInformativeCommand Injection - Generic · critical
    6 votes
  89. [DOS] denial of service using code snippet on brave browserUncontrolled Resource Consumption · low
    6 votes
  90. `settingcontent-ms` files lacks "mark of the web" => execute code by dbl click in Downloads toolbarInformativelow
    5 votes
  91. Address bar spoofing in Brave browser via. window close warningsInformativeViolation of Secure Design Principles · medium
    5 votes
  92. invalid homepage URL causes 'uncaught typeerror' or blank stateViolation of Secure Design Principles · low
    5 votes
  93. Denial of service attack on Brave Browser.Uncontrolled Resource Consumption · low
    5 votes
  94. Link obfuscation bugInformativeCryptographic Issues - Generic · low
    4 votes
  95. Directory Listing on https://promo-services-staging.brave.comInformativeInformation Disclosure
    4 votes
  96. OPEN REDIRECTION at every 302 HTTP CODEN/AOpen Redirect · low
    4 votes
  97. links the user may download can be a malicious filesInformativeCode Injection · high
    4 votes
  98. JavaScript URL Issues in the latest version of Brave BrowserInformativemedium
    4 votes
  99. Javascript confirm() crashes Brave on PCInformativeUncontrolled Resource Consumption · medium
    4 votes
  100. UI spoofing by showing sms:/tel: dialog on another websitePhishing · low
    3 votes