Information Leakage in Brave Browser's Private Window with Tor Connectivity

CVE-2022-30334

What is CVE-2022-30334?

Brave Browser versions prior to 1.34 exhibit a vulnerability in which, when using a Private Window with Tor Connectivity, sensitive .onion URLs can be inadvertently exposed through Referer and Origin headers. This leakage poses a significant risk to user privacy, as these URLs are typically intended to provide anonymity on the Tor network. Although Brave has addressed this issue in subsequent updates, it is important to note that their documentation continues to caution users that these Private Windows function similarly to regular private windows, utilizing Tor simply as a proxy without implementing many of the privacy features present in the Tor Browser itself.

References