CVE-2021-22916 Information disclosure in https://github.com/brave/brave-core
Brave browser leaks DNS requests via system settings instead of proxy when adblocking and proxy extensions are active, exposing user data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-22916?
CVE-2021-22916 is a medium-severity vulnerability in https://github.com/brave/brave-core, published on 12 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Brave Desktop between versions 1.17 and 1.26.60, when adblocking is enabled and a proxy browser extension is installed, the CNAME adblocking feature issues DNS requests that used the system DNS settings instead of the extension's proxy settings, resulting in possible information disclosure.
Weakness: CWE-200
Which versions are affected by CVE-2021-22916?
It affects 1 product.
Products include Brave Brave.
How do I fix CVE-2021-22916?
No fix has been published for CVE-2021-22916 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-22916 being exploited?
There is no known exploitation of CVE-2021-22916 in the wild and no public exploit code.
Other vulnerabilities in https://github.com/brave/brave-core
Sources
Also known as GHSA-x7j4-9cp2-wmh8.