Brave Software · Report #3693295
iOS Brave Playlist "Open in Private Tab" bypasses FaceID requirement for Private Tabs
Summary
An attacker with physical access may be able to bypass Face ID or Passcode Authentication of Brave Private Tabs via Brave Playlist. This was addressed by ensuring Face ID is required from the Brave Playlist when opening new private tab.
How it was found
Summary:
Adding/Opening a song in your Brave playlist and holding for the option of "Open in new Private Tab" bypasses FaceID/Passcode Requirement for Private Tabs.
Products affected:
Brave iOS version: 1.88 iOS version: 26.4.2 Brave Browser Private Tab FaceID Protection
Steps To Reproduce:
Step 1: Enable FaceID Protection for Private Tabs and Keep Private Tabs in Brave Settings Step 2: Open Private Tabs and browse any websites Step 3: Exit out of Private Tabs and add any song or audio to your Brave Playlist. (For this PoC, I used a Youtube video) Step 4: Enter your Brave Playlist and go to the song you just added. Step 5: Tap and hold the song until a dropdown menu appears. Step 6: Tap on the option to "Open in a New Private Tab"
You will now be able to access the content of Private Tabs without any FaceID or Passcode Authentication.
Supporting Material/References:
Please check PoC video below
Impact
An attacker may be able to access content of Private Tabs without FaceID or Passcode Authentication.