CVE-2023-28360 Security feature bypass in https://laptop-updates.brave.com/latest/winx64

Medium 4.3 Published 11 May 2023 Updated 27 Jan 2025

Brave browser fails to display download safety checks, allowing users to save potentially malicious files without warning.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-28360?

CVE-2023-28360 is a medium-severity vulnerability in https://laptop-updates.brave.com/latest/winx64, published on 11 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An omission of security-relevant information vulnerability exists in Brave desktop prior to version 1.48.171 when a user was saving a file there was no download safety check dialog presented to the user.

Weakness: CWE-223

Which versions are affected by CVE-2023-28360?

It affects 1 product.

Products include Brave Brave.

How do I fix CVE-2023-28360?

No fix has been published for CVE-2023-28360 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-28360 being exploited?

There is no known exploitation of CVE-2023-28360 in the wild and no public exploit code.

Sources

Also known as GHSA-mcpc-4w6j-6xpq.