CVE-2025-23086

On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site prompts the user to upload or download a file. However the origin was not correctly inferred in some cases. When combined with an open redirector vulnerability on a trusted site, this could allow a malicious site to initiate a download whose origin in the file select dialog appears as the trusted site which initiated the redirect.

• CWE-601

• https://hackerone.com/reports/2888770

Published

Jan 21, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-23080Improper Neutralization of Input During Web Page Generation …5.3
• CVE-2025-23081Cross-Site Request Forgery (CSRF), Improper Neutralization o…6.1
• CVE-2025-23082Veeam Backup for Microsoft Azure is vulnerable to Server-Sid…7.2
• CVE-2025-23083With the aid of the diagnostics_channel utility, an event ca…7.7
• CVE-2025-23084A vulnerability has been identified in Node.js, specifically…5.5
• CVE-2025-23085A memory leak could occur when a remote peer abruptly closes…5.3
• CVE-2025-23087Rejected reason: This Record was REJECTED after determining …
• CVE-2025-23088Rejected reason: This Record was REJECTED after determining …
• CVE-2025-23089Rejected reason: This Record was REJECTED after determining …
• CVE-2025-2309A vulnerability has been found in HDF5 1.14.6 and classified…7.8
• CVE-2025-23090Rejected reason: This CVE record has been withdrawn due to a…
• CVE-2025-23091An Improper Certificate Validation on UniFi OS devices, with…5.9