Privacy Issue in Brave Desktop Analytics System Affecting User Incognito Windows
CVE-2020-8276

5.5MEDIUM

Key Information:

Vendor

Brave

Status
Https://github.com/brave/brave-core
Vendor
CVE Published:
9 November 2020

What is CVE-2020-8276?

A privacy concern has been identified in Brave Desktop's analytics system, affecting versions between 1.1 and 1.18.35. This issue involves the logging of timestamps for when users open incognito windows, including those using Tor. Instead of properly excluding Tor windows from this logging function, the system potentially retains this sensitive information. However, while the logs are not sent to external servers, their local storage may present a minimal risk if accessed by a local attacker with disk access. The logging behavior is designed to track the usage of incognito windows, categorized into intervals since last use.

Affected Version(s)

https://github.com/brave/brave-core v1.18.35

References

https://hackerone.com/reports/1024668
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.