File Origin Spoofing Vulnerability in Brave Browser

CVE-2025-23086

What is CVE-2025-23086?

The Brave Browser versions 1.70.x to 1.73.x feature a file selector dialog that showcases a site's origin during file uploads or downloads. However, an oversight in origin inference can occur under certain conditions. If a malicious site uses an open redirect vulnerability on a trusted site, it may trigger downloads that misleadingly appear to originate from the trusted entity in the file selector. This could mislead users into executing potentially harmful downloads while believing they are interacting with a secure, trusted source.

References