Information Disclosure in Brave Desktop due to DNS Misconfiguration

CVE-2021-45884

What is CVE-2021-45884?

In versions 1.17 to 1.33 of Brave Desktop, a flaw arises when CNAME-based adblocking is combined with a proxying extension that uses a SOCKS fallback. This can inadvertently trigger additional DNS queries that bypass the intended proxying extension and utilize the system's standard DNS settings. Consequently, this may lead to exposure of sensitive information, which has roots in incomplete fixes for prior vulnerabilities. Affected users should promptly update their software to mitigate risks associated with this vulnerability.

References