Browse / Brave Software

Brave Software

See its reports on the map

Attack surface: 417 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Brave Software

• Misconfiguration27
• Information Disclosure17
• Code Execution13
• Cross-site Scripting10
• Other weaknesses9
• Denial of Service9

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Brave Browser Tor Window leaks user's real IP to the external DNS serverInformation Disclosure · high
   280 votes
2. Open redirect due to scanning QR code via brave browserOpen Redirect · high
   148 votes
3. Stored XSS in localhost:* via integrated torrent downloaderCross-site Scripting (XSS) - Stored · medium
   124 votes
4. Null Pointer Dereference by Crafted Response from AI ModelNULL Pointer Dereference · low
   116 votes
5. Incorrect security UI of files' download source on brave MacOSUser Interface (UI) Misrepresentation of Critical Information · high
   87 votes
6. Cookie steal through content UriWeak Password Recovery Mechanism for Forgotten Password · critical
   79 votes
7. Local files reading from the web using `brave://`Path Traversal · critical
   74 votes
8. SameSite restrictions are lifted, and SameSite:Strict cookie are being sent.Improper Certificate Validation · high
   73 votes
9. New XSS vector in ReaderMode with %READER-TITLE-NONCE%Cross-site Scripting (XSS) - Generic · critical
   72 votes
10. UXss on brave browser via scan QR CodeCross-site Scripting (XSS) - Generic · high
    68 votes
11. Sending arbitrary IPC messages via overriding Function.prototype.applyCommand Injection - Generic · critical
    53 votes
12. Brave Shields Domain Reordering Leads to Origin ConfusionViolation of Secure Design Principles · low
    52 votes
13. Lack of quarantine meta-attribute for downloaded files leads to GateKeeper bypassViolation of Secure Design Principles · low
    52 votes
14. DNS Leaks when using any VPN Browser extension with Brave Shield enabledInformation Disclosure · high
    51 votes
15. iOS Brave Playlist "Open in Private Tab" bypasses FaceID requirement for Private TabsImproper Authentication - Generic · medium
    49 votes
16. `chrome://brave` available for navigation in Release build [-> RCE] + navigation to `chrome://*` using tab_helper ["Open in new tab"]Code Injection · high
    46 votes
17. Brave Android: Incorrect URL Eliding in Brave Shields Pop UpViolation of Secure Design Principles · low
    45 votes
18. Local files reading using `link[rel="import"]`Path Traversal · high
    43 votes
19. [Android] HTML Injection in BatterySaveArticleRenderer WebViewCross-site Scripting (XSS) - Generic · high
    43 votes
20. Information disclosure-Referer leakInformation Disclosure · high
    42 votes
21. Browser is not following proper flow for redirection cause open redirect Open Redirect · high
    41 votes
22. Onion-Location header allows to open arbitrary URLs including chrome:Violation of Secure Design Principles · high
    40 votes
23. UAF on JSEthereumProviderUse After Free · critical
    38 votes
24. download file type warning on Windows does not appear if "ask where to save file before downloading" setting is enabledhigh
    31 votes
25. HTML injection in title of reader viewCross-site Scripting (XSS) - DOM · medium
    30 votes
26. [iOS/Android] Address Bar Spoofing Vulnerability Violation of Secure Design Principles
    30 votes
27. Universal XSS with Playlist featureCross-site Scripting (XSS) - Stored · high
    27 votes
28. Navigation to protocol handler URL from the opened page displayed as a request from this page.medium
    25 votes
29. S3 Bucket Takeover "brave-browser-rpm-staging-release-test"Improper Access Control - Generic
    24 votes
30. XSS on Brave Today through custom RSS feedCross-site Scripting (XSS) - DOM · medium
    24 votes
31. Local files reading from the "file://" origin through `brave://`Path Traversal · high
    24 votes
32. Open redirect found on account.brave.comOpen Redirect · medium
    21 votes
33. chrome://brave navigation from webCode Injection · critical
    21 votes
34. URL Spoof / Brave Shield BypassUse of Inherently Dangerous Function · high
    21 votes
35. DMARC RECORD MISSINGMisconfiguration · low
    20 votes
36. S3 Bucket Takeover : brave-aptImproper Access Control - Generic · medium
    19 votes
37. Brave Browser permanently timestamps & logs connection times for all v2 domains ~/.config/BraveSoftware/Brave-Browser/tor/data/tor.logCleartext Storage of Sensitive Information · medium
    19 votes
38. https://publishers.basicattentiontoken.org/favicon.ico is Vulnerable to CVE-2017-7529Array Index Underflow · medium
    18 votes
39. No rate limiting for confirmation email lead to email flooding and leads to enumeration of emails in publishers.basicattentiontoken.orgViolation of Secure Design Principles · low
    18 votes
40. Universal XSS through FIDO U2F register from subframeCross-site Scripting (XSS) - Generic · high
    17 votes
41. RCE: DnDing shortcut files to chrome://brave allows loading HTML files in Muon's contextCode Injection · high
    16 votes
42. Arbitrary file download due to bad handling of Redirects in WebTorrentCode Injection · medium
    15 votes
43. Bypassing Homograph Attack Using /@ [ Tested On Windows ]Violation of Secure Design Principles · low
    15 votes
44. Homograph Attack Bypass [ Tested on Linux & Windows ]Violation of Secure Design Principles · low
    15 votes
45. Persistent user tracking is possible using window.caches, by avoiding Brave ShieldsPrivacy Violation · medium
    14 votes
46. Redirecting users to malicious torrent-files/websites using WebTorrentViolation of Secure Design Principles · medium
    14 votes
47. URL spoofing in Brave for macOSViolation of Secure Design Principles · medium
    14 votes
48. Homograph attackViolation of Secure Design Principles · low
    14 votes
49. [ios] Address bar spoofing in Brave for iOSViolation of Secure Design Principles · low
    13 votes
50. Access to local file system using javascriptPath Traversal · medium
    13 votes
51. Brave News feeds can open arbitrary chrome: URLsPrivilege Escalation · high
    12 votes
52. Security token and handler name leak from window.braveBlockRequestsInformation Disclosure · high
    12 votes
53. Phishing/Malware site blocking on Brave iOS can be bypassed with trailing dot in hostnameViolation of Secure Design Principles · medium
    12 votes
54. chrome://brave can still be navigated to, leading to RCECode Injection · high
    12 votes
55. Navigation to restricted origins via "Open in new tab"Improper Access Control - Generic · medium
    12 votes
56. Arbitrary file download via "Save .torrent file" option can lead to Client RCE and XSSCode Injection · medium
    11 votes
57. Navigation to `chrome-extension://` origin (internal pages) from the weblow
    11 votes
58. Unsafe handling of protocol handlerslow
    11 votes
59. Download attribute allows downloading local filesPath Traversal · low
    11 votes
60. Cross-origin page stays focused before/after downloading + uninformative modal window for downloadlow
    10 votes
61. application/x-brave-tab should not be readable.Privacy Violation · high
    10 votes
62. [website] Script injection in newsletter signup https://brave.com/brave_youth_program_signup.htmlCommand Injection - Generic · medium
    10 votes
63. Brave Shield for iOS is weak against IDN homograph attacksPhishing · low
    9 votes
64. [Brave browser] WebTorrent has DNS rebinding vulnerabilityInformation Disclosure · low
    9 votes
65. URL spoofing using protocol handlersViolation of Secure Design Principles · medium
    9 votes
66. Torrent Viewer extension web service available on all interfacesInformation Disclosure · medium
    9 votes
67. Brave Browser unexpectedly allows to send arbitrary IPC messagesCommand Injection - Generic · critical
    9 votes
68. [DOS] Browser hangs on loading the code snippetUncontrolled Resource Consumption · low
    9 votes
69. Field Day With Protocol Handlersmedium
    8 votes
70. DoS in Brave browser for iOSUncontrolled Resource Consumption · low
    8 votes
71. Address Bar Spoofing - Already resolved - Retroactive reportOpen Redirect · low
    8 votes
72. Status Bar ObfuscationCryptographic Issues - Generic · low
    8 votes
73. XSS on internal: privileged origin through reader modeCross-site Scripting (XSS) - Generic · high
    7 votes
74. Brave Browser potentially logs the last time a Tor window was usedCleartext Storage of Sensitive Information · low
    7 votes
75. URI ObfuscationHTTP Response Splitting · medium
    7 votes
76. 2 Directory Listing on ledger.brave.com & vault-staging.brave.comInformation Disclosure · low
    7 votes
77. OS username disclosurePrivacy Violation · low
    6 votes
78. [iOS] URL can be replaceState by blob URL in iOS BraveViolation of Secure Design Principles · low
    6 votes
79. [DOS] denial of service using code snippet on brave browserUncontrolled Resource Consumption · low
    6 votes
80. invalid homepage URL causes 'uncaught typeerror' or blank stateViolation of Secure Design Principles · low
    5 votes
81. Denial of service attack on Brave Browser.Uncontrolled Resource Consumption · low
    5 votes
82. UI spoofing by showing sms:/tel: dialog on another websitePhishing · low
    3 votes
83. No user confirmation when an auto-updated extension gets more permissionsViolation of Secure Design Principles · low
    3 votes
84. Denial of service attack(window object) on brave browserUncontrolled Resource Consumption · medium
    2 votes