Description (CNA)
On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site prompts the user to upload or download a file. However the origin was not correctly inferred in some cases. When combined with an open redirector vulnerability on a trusted site, this could allow a malicious site to initiate a download whose origin in the file select dialog appears as the trusted site which initiated the redirect.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Brave / Desktop Browser | affected 1.74.48 before 1.74.48; unaffected 1.70.117 before 1.70.117 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.