Medium severity · published Dec 20, 2018
CVE-2018-1000815
Brave Software Inc. Brave version version 0.22.810 to 0.24.0 contains a Other/Unknown vulnerability in function ContentSettingsObserver::AllowScript() in…
4.3
CVSS
1.1%
EPSS
No
On KEV
Description
Brave Software Inc. Brave version version 0.22.810 to 0.24.0 contains a Other/Unknown vulnerability in function ContentSettingsObserver::AllowScript() in content_settings_observer.cc that can result in Websites can run inline JavaScript even if script is blocked, making attackers easier to track users. This attack appear to be exploitable via the victim must visit a specially crafted website. This vulnerability appears to have been fixed in 0.25.2.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BR
Brave · Brave
0.22.810 through 0.24.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1000815
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1000815
Patch
https://github.com/brave/browser-laptop/issues/15232
Patch
https://github.com/brave/muon/commit/c18663aa171c6cdf03da3e8c70df8663645b97c4
Patch
https://github.com/brave/muon/pull/651
More from Brave
7.5
CVE-2021-45884
In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requests are issued…
6.5
CVE-2022-47934
Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file that mentions an ipfs:// or ipns:// URL
6.5
CVE-2022-47933
Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme
6.5
CVE-2022-47932
Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:// or ipns:// URL
6.5
CVE-2018-10799
A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux)