Read the docs
TI-2025-31108 Aliases CVE-2025-48980GHSA-5w5v-4m3m-w7hq

In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature…

Priority LOW 29CWE-565Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA.

Summary

In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item did not respect the SameSite cookie attribute. Therefore SameSite=Strict cookies would be sent on a cross-site navigation using this method.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0033 26th percentileScored 2026-11-07
Fix Fixed Desktop Browser (Brave): 1.83.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BraveDesktop Browser1.83.10 to before 1.83.101.83.10Patch availableCNA
  • Desktop Browser VendorBrave Affected 1.83.10 to before 1.83.10 Fixed in 1.83.10 Patch available CNA

Remediation

  • Fix · CNA Desktop Browser (Brave) Fixed in 1.83.10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-48980
  2. 2026-10-03 Alias added: GHSA-5w5v-4m3m-w7hq

References

Other 1

  • TI-2024-24910 Improper input validation in Brave Android Browser CVSS 3.1HIGH 7.5
  • TI-2022-23748 Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in… CVSS 3.1MEDIUM 6.5
  • TI-2022-23747 Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a… CVSS 3.1MEDIUM 6.5
  • TI-2023-12910 Open redirect in Brave Browser Android CVSS 3.1MEDIUM 6.1
  • TI-2017-05997 Brave 0.12.4 has a Status Bar Obfuscation issue in which a redirection target is shown in… CVSS 3.1MEDIUM 5.3
  • TI-2025-07036 Brave Conversion Engine (PRO) <= 0.7.7 - Authentication Bypass to Administrator CVSS 3.1CRITICAL 9.8
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences