CVE-2021-22917 Information disclosure in https://github.com/brave/brave-core

Medium 6.5 Published 12 Jul 2021 Updated 3 Aug 2024

Brave Browser leaks DNS requests outside Tor when adblocking is enabled, exposing user browsing activity to network observers.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2021-22917?

CVE-2021-22917 is a medium-severity vulnerability in https://github.com/brave/brave-core, published on 12 Jul 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Brave Browser Desktop between versions 1.17 and 1.20 is vulnerable to information disclosure by way of DNS requests in Tor windows not flowing through Tor if adblocking was enabled.

Weakness: CWE-200

Which versions are affected by CVE-2021-22917?

It affects 1 product.

Products include Brave Browser.

How do I fix CVE-2021-22917?

No fix has been published for CVE-2021-22917 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-22917 being exploited?

There is no known exploitation of CVE-2021-22917 in the wild and no public exploit code.

Sources

Also known as GHSA-gvj3-42m2-8xqw.