CVE-2025-23086 - CVE House
Back to Database
Status published Unknown CVE-2025-23086

On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a...

Vulnerability Description

On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site prompts the user to upload or download a file. However the origin was not correctly inferred in some cases. When combined with an open redirector vulnerability on a trusted site, this could allow a malicious site to initiate a download whose origin in the file select dialog appears as the trusted site which initiated the redirect.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-23086

Credits & Attribution

No credits recorded in the NVD database.

References

More from Brave

View All →
CVE-2025-7710
Brave Conversion Engine (PRO) <= 0.7.7 - Authentication Bypass to Administrator
Critical 9.8
CVE-2025-68508
WordPress Brave plugin <= 0.8.3 - Broken Access Control vulnerability
Medium 5.3
CVE-2025-48980
In Brave Browser Desktop versions prior to 1.83.10 that have...
Medium 6.5
CVE-2024-43337
WordPress Brave plugin <= 0.7.0 - Cross Site Request Forgery (CSRF) vulnerability
Medium 4.3
CVE-2024-37406
In Brave Android prior to v1.67.116, domains in the Brave...
Unknown 0

Affected Vendor

Affected Software

Desktop Browser
Vulnerable Versions:
1.74.48, 1.70.117

Timeline

Official Publish: January 21st, 2025
Last Modified: March 22nd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.