CVE-2018-1000815: Input Validation
Brave Software Inc. Brave version version 0.22.810 to 0.24.0 contains a Other/Unknown vulnerability in function ContentSettingsObserver::AllowScript() in contentsettingsobserver.cc that can result in Websites can run inline JavaScript even if script is blocked, making attackers easier to track users. This attack appear to be exploitable via the victim must visit a specially crafted website. This vulnerability appears to have been fixed in 0.25.2.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this Brave Software Inc. Brave vulnerability?
The vulnerability ID for this Brave Software Inc. Brave vulnerability is CVE-2018-1000815.
What is the severity of CVE-2018-1000815?
The severity of CVE-2018-1000815 is medium.
How does CVE-2018-1000815 affect Brave Software Inc. Brave?
CVE-2018-1000815 allows websites to run inline JavaScript even if the script is blocked, making it easier for attackers to track users on Brave Software Inc. Brave versions 0.22.810 to 0.24.0.
How can the CVE-2018-1000815 vulnerability be fixed?
To fix the CVE-2018-1000815 vulnerability, users should update their Brave Software Inc. Brave version to a version higher than 0.24.0.
Where can I find more information about CVE-2018-1000815?
You can find more information about CVE-2018-1000815 on the following websites: [https://github.com/brave/browser-laptop/issues/15232](https://github.com/brave/browser-laptop/issues/15232), [https://github.com/brave/muon/commit/c18663aa171c6cdf03da3e8c70df8663645b97c4](https://github.com/brave/muon/commit/c18663aa171c6cdf03da3e8c70df8663645b97c4), [https://github.com/brave/muon/pull/651](https://github.com/brave/muon/pull/651).