Brave
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Brave | 3 | – | Oct 29, 2026 |
| Brave Popup Builder | 2 | – | Aug 26, 2024 |
| Desktop Browser | 2 | – | Oct 30, 2025 |
| Brave Conversion Engine (PRO) | 1 | – | Aug 2, 2025 |
| brave-browser | 1 | – | Feb 23, 2021 |
| Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content | 1 | – | Feb 1, 2024 |
| Android Browser | 1 | – | Sep 18, 2024 |
Exploited and recent CVEs
- CVE-2026-48202 WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability 0.3%
- CVE-2025-68508 WordPress Brave plugin <= 0.8.3 - Broken Access Control vulnerability 0.2%
- CVE-2025-48980 In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item did not respect the SameSite cookie attribute. Therefore Sa 0.3%
- CVE-2025-7710 Brave Conversion Engine (PRO) <= 0.7.7 - Authentication Bypass to Administrator 0.7%
- CVE-2025-23086 On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site prompts the user to upload or download a 0.4%
- CVE-2024-37406 In Brave Android prior to v1.67.116, domains in the Brave Shields popup are elided from the right instead of the left, which may lead to domain confusion. 0.4%
- CVE-2024-43337 WordPress Brave plugin <= 0.7.0 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
- CVE-2024-35655 WordPress Brave – Interactive Content plugin <= 0.6.9 - Cross Site Scripting (XSS) vulnerability 0.3%
- CVE-2024-30453 WordPress Brave plugin <= 0.6.5 - Server Side Request Forgery (SSRF) vulnerability 0.3%
- CVE-2023-51534 WordPress Brave Popup Builder Plugin <= 0.6.2 is vulnerable to Cross Site Scripting (XSS) 0.3%
- CVE-2021-21323 Regression in DNS leakage from Tor windows 2.3%