CVE-2024-37406 Other in Android Browser
Domain confusion in Brave Shields popup allows attackers to spoof domains, potentially bypassing security indicators in the Brave Android browser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-37406?
CVE-2024-37406 is a high-severity vulnerability in Brave Android Browser, published on 18 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Brave Android prior to v1.67.116, domains in the Brave Shields popup are elided from the right instead of the left, which may lead to domain confusion.
Weakness: CWE-20
Which versions are affected by CVE-2024-37406?
How do I fix CVE-2024-37406?
No fix has been published for CVE-2024-37406 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-37406 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-37406 exists.
Sources
Also known as GHSA-p47r-4xrv-2qwg.