Medium severity · published Mar 28, 2017
CVE-2016-9473
Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier suffer from Full Address Bar Spoofing, allowing attackers to trick a victim by displaying a malicious…
4.7
CVSS
1.9%
EPSS
No
On KEV
Description
Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier suffer from Full Address Bar Spoofing, allowing attackers to trick a victim by displaying a malicious page for legitimate domain names.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BR
Browser · Brave
before 1.2.18; before 1.9.56 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-9473
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-9473
Third Party Advisory
http://www.securityfocus.com/bid/97155
Exploit
https://cxsecurity.com/issue/WLB-2017010042
Broken Link
https://github.com/brave/browser-ios/pull/504
Exploit
https://hackerone.com/reports/175958
More from Browser
6.5
CVE-2021-22917
Brave Browser Desktop between versions 1.17 and 1.20 is vulnerable to information disclosure by way of DNS requests in Tor windows not flowing through Tor if adblocking was…
6.1
CVE-2023-52263
Brave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and redirect
6.1
CVE-2023-28364
An Open Redirect vulnerability exists prior to version 1.52.117, where the built-in QR scanner in Brave Browser Android navigated to scanned URLs automatically without showing the…
4.7
CVE-2017-1000461
Brave Software's Brave Browser, version 0.19.73 (and earlier) is vulnerable to an incorrect access control issue in the "JS fingerprinting blocking" component, resulting in a…