PT-2020-20076 · Brave · Brave Desktop

Published 2020-11-05 · Updated 2020-11-18 · CVE-2020-8276

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Brave Desktop versions 1.1 through 1.18.35

Description The implementation of Brave Desktop's privacy-preserving analytics system (P3A) logged the timestamp of when the user last opened an incognito window, including Tor windows, instead of excluding Tor windows as intended. If a user has P3A enabled, the timestamp is not sent to Brave's server, but rather a value indicating usage frequency, such as Used in last 24h, Used in last week but not 24h, Used in last 28 days but not week, Ever used but not in last 28 days, or Never used. The privacy risk is low because a local attacker with disk access cannot determine if the timestamp corresponds to a Tor window or a non-Tor incognito window.

Recommendations For versions 1.1 through 1.18.35, update to a version later than 1.18.35 to resolve the issue. As a temporary workaround, consider disabling the P3A system until a patch is available. Restrict access to incognito windows and Tor windows to minimize the risk of exploitation. Avoid using the P3A system until the issue is resolved.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2020-8276

Affected Products

Brave Desktop

References · 8

• 🔥 https://hackerone.com/reports/1024668 · Exploit
• https://osv.dev/vulnerability/CVE-2020-8276 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8276 · Security Note
• https://t.me/ckure/5900 · Telegram Post
• https://t.me/cibsecurity/16030 · Telegram Post
• https://t.me/cvenotify/5767 · Telegram Post
• https://t.me/secharvester/10118 · Telegram Post
• https://t.me/thebugbountyhunter/4869 · Telegram Post