Brave Software · disclosed reports
Information Disclosure
15 disclosed reports · $0 paid
Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Brave Software on HackerOne- reports
- 15
- paid a bounty
- 0
Every one of the 15 is a mark on the map. Named now: 1 to 15, most upvoted first.
- Brave Browser Tor Window leaks user's real IP to the external DNS server
- DNS Leaks when using any VPN Browser extension with Brave Shield enabled
- Information disclosure-Referer leak
- Username Information Disclosure via Json response - Using parameter number Intruder
- Persistent user tracking is possible using window.caches, by avoiding Brave Shields
- Security token and handler name leak from window.braveBlockRequests
- application/x-brave-tab should not be readable.
- [Brave browser] WebTorrent has DNS rebinding vulnerability
- Torrent Viewer extension web service available on all interfaces
- 2 Directory Listing on ledger.brave.com & vault-staging.brave.com
- OS username disclosure
- Directory Listing on https://promo-services-staging.brave.com
- Information disclosure of website
- Information disclosure
- Brave payments remembers history even after clearing all browser data.
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.