Read the docs
TI-2016-07744 Aliases CVE-2016-9473GHSA-93xm-4rmr-qw86

Cross-site scripting in Brave Software Brave Browser iOS before 1.2.18 and Brave Browser…

Priority LOW 25CWE-451Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing, Cross-site scripting
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-451 and CWE-79.

Summary

Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier suffer from Full Address Bar Spoofing, allowing attackers to trick a victim by displaying a malicious page for legitimate domain names.

Why it matters now

EPSS 0.01935 80th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Brave Software Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlierBrave Software Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier—No fix listedCNA
  • Brave Software Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier Vendor— Affected Brave Software Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:brave:browser:*:*:*:*:*:iphone_os:*:*before 1.2.18VulnerableBrave
cpe:2.3:a:brave:browser:*:*:*:*:*:android:*:*before 1.9.56VulnerableBrave
  • cpe:2.3:a:brave:browser:*:*:*:*:*:iphone_os:*:* Versions before 1.2.18 Vulnerable ·Brave
  • cpe:2.3:a:brave:browser:*:*:*:*:*:android:*:* Versions before 1.9.56 Vulnerable ·Brave

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-9473
  2. 2026-10-03 Alias added: GHSA-93xm-4rmr-qw86

References

Exploit 1

Other 1

  • TI-2023-12910 Open redirect in Brave Browser Android CVSS 3.1MEDIUM 6.1
  • TI-2021-05778 Information disclosure in https://github.com/brave/brave-core CVSS 3.1MEDIUM 6.5
  • TI-2023-28673 Brave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and… CVSS 3.1MEDIUM 6.1
  • TI-2017-14672 Brave Software's Brave Browser, version 0.19.73 (and earlier) is vulnerable to an… CVSS 3.0MEDIUM 4.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences