Read the docs
TI-2025-30744 Aliases CVE-2025-48464GHSA-4v24-3w3q-g36w

Exposure of sensitive information in DuckDuckGo Browser

Priority LOW 21CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim’s Sync account data such as account credentials and email protection information.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00139 3rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DuckDuckGoDuckDuckGo Browserup to 5.246.0—No fix listedCNA
  • DuckDuckGo Browser VendorDuckDuckGo Affected up to 5.246.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-48464
  2. 2026-10-03 Alias added: GHSA-4v24-3w3q-g36w

References

Other 2

  • TI-2018-04998 In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to… CVSS 3.0MEDIUM 4.3
  • TI-2021-20209 The DuckDuckGo browser 7.64.4 on iOS allows Address Bar Spoofing due to mishandling of… CVSS 3.1HIGH 8.2
  • TI-2020-12206 The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences