CVE-2022-30334

Brave before 1.34, when a Private Window with Tor Connectivity is used, leaks .onion URLs in Referer and Origin headers. NOTE: although this was fixed by Brave, the Brave documentation still advises "Note that Private Windows with Tor Connectivity in Brave are just regular private windows that use Tor as a proxy. Brave does NOT implement most of the privacy protections from Tor Browser."

• CWE-200

• https://github.com/brave/brave-browser/issues/18071Issue Tracking, Third Party Advisory
• https://github.com/brave/brave-core/pull/10760Exploit, Patch, Third Party Advisory
• https://hackerone.com/reports/1337624Exploit, Third Party Advisory
• https://support.brave.com/hc/en-us/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity-Vendor Advisory
• https://github.com/brave/brave-browser/issues/18071Issue Tracking, Third Party Advisory
• https://github.com/brave/brave-core/pull/10760Exploit, Patch, Third Party Advisory
• https://hackerone.com/reports/1337624Exploit, Third Party Advisory
• https://support.brave.com/hc/en-us/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity-Vendor Advisory

Published

May 7, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30329An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 …9.8
• CVE-2022-3033If a Thunderbird user replied to a crafted HTML email contai…8.1
• CVE-2022-30330In the KeepKey firmware before 7.3.2,Flaws in the supervisor…6.6
• CVE-2022-30331The User-Defined Functions (UDF) feature in TigerGraph 3.6.0…8.8
• CVE-2022-30332In Talend Administration Center 7.3.1.20200219 before TAC-15…5.3
• CVE-2022-30333RARLAB UnRAR before 6.12 on Linux and UNIX allows directory …7.5
• CVE-2022-30335Bonanza Wealth Management System (BWM) 7.3.2 allows SQL inje…9.8
• CVE-2022-30337Cross-Site Request Forgery (CSRF) vulnerability in JoomUnite…4.3
• CVE-2022-30338Incorrect default permissions in the Intel(R) VROC software …7.8
• CVE-2022-30339Out-of-bounds read in firmware for the Intel(R) Integrated S…4.4
• CVE-2022-3034When receiving an HTML email that specified to load an <code…4.3
• CVE-2022-30349siteserver SSCMS 6.15.51 is vulnerable to Cross Site Scripti…6.1