Brave Software · disclosed reports
No weakness filed
26 disclosed reports · $0 paid
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Brave Software on HackerOne- reports
- 26
- paid a bounty
- 0
Every one of the 26 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Local files reading from the web using `brave://`
- `chrome://brave` available for navigation in Release build [-> RCE] + navigation to `chrome://*` using tab_helper ["Open in new tab"]
- Local files reading using `link[rel="import"]`
- Browser is not following proper flow for redirection cause open redirect
- download file type warning on Windows does not appear if "ask where to save file before downloading" setting is enabled
- Navigation to protocol handler URL from the opened page displayed as a request from this page.
- Local files reading from the "file://" origin through `brave://`
- DMARC RECORD MISSING
- RCE: DnDing shortcut files to chrome://brave allows loading HTML files in Muon's context
- URL spoofing in Brave for macOS
- [ios] Address bar spoofing in Brave for iOS
- Access to local file system using javascript
- Torrent extension: Cross-origin downloading + "URL spoofing" + CSP-blocked XSS
- Navigation to restricted origins via "Open in new tab"
- Navigation to `chrome-extension://` origin (internal pages) from the web
- Unsafe handling of protocol handlers
- Download attribute allows downloading local files
- Cross-origin page stays focused before/after downloading + uninformative modal window for download
- URL spoofing using protocol handlers
- Field Day With Protocol Handlers
- `alert()` dialogs on `chrome-extension://` origin (internal pages)
- `settingcontent-ms` files lacks "mark of the web" => execute code by dbl click in Downloads toolbar
- JavaScript URL Issues in the latest version of Brave Browser
- Javascript confirm() crashes Brave on PC
- Cross domain tracking even with 3rd party cookies disabled.
- homograph-attack (unicode vuln)
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.