Browse / Brave Software

Brave Software

See its reports on the map

Attack surface: 417 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Brave Software

• Misconfiguration27
• Information Disclosure17
• Code Execution13
• Cross-site Scripting10
• Other weaknesses9
• Denial of Service9

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Prompt Injection via GitHub Patch in Brave AI Chat (Leo)InformativeLLM01: Prompt Injection · high
   77 votes
2. Username Information Disclosure via Json response - Using parameter number IntruderInformativeInformation Disclosure · low
   16 votes
3. unclaimed s3 bucket takeover in the 3 js file located on the github page of brave softwareInformativeBusiness Logic Errors · low
   15 votes
4. HTTP Request SmugglingInformativeHTTP Request Smuggling · high
   12 votes
5. Sending arbitrary IPC messages via overriding Array.prototype.pushInformativeCommand Injection - Generic · critical
   6 votes
6. `settingcontent-ms` files lacks "mark of the web" => execute code by dbl click in Downloads toolbarInformativelow
   5 votes
7. Address bar spoofing in Brave browser via. window close warningsInformativeViolation of Secure Design Principles · medium
   5 votes
8. Link obfuscation bugInformativeCryptographic Issues - Generic · low
   4 votes
9. Directory Listing on https://promo-services-staging.brave.comInformativeInformation Disclosure
   4 votes
10. links the user may download can be a malicious filesInformativeCode Injection · high
    4 votes
11. JavaScript URL Issues in the latest version of Brave BrowserInformativemedium
    4 votes
12. Javascript confirm() crashes Brave on PCInformativeUncontrolled Resource Consumption · medium
    4 votes
13. Cross-origin resource sharing misconfiguration (CORS)InformativeImproper Access Control - Generic
    3 votes
14. Information disclosure of websiteInformativeInformation Disclosure · high
    3 votes
15. [iOS] URI Obfuscation in iOS applicationInformativeHTTP Response Splitting · low
    3 votes
16. Cross domain tracking even with 3rd party cookies disabled.InformativeMisconfiguration
    2 votes
17. Clickjacking or URL Masking InformativeImproper Authentication - Generic · medium
    2 votes
18. Brave: Admin Panel AccessInformativeViolation of Secure Design Principles · medium
    2 votes
19. Brave allows flash to follow 307 redirects to other origins with arbitrary content-typesInformativeViolation of Secure Design Principles · medium
    1 votes
20. Download of (later executed) .NET installer over insecure channelInformativeMan-in-the-Middle · low
    1 votes
21. DOS in browser using window.print() functionInformativeUncontrolled Resource Consumption