Brave, by default, connects to third-party domains with the Top Sites feature to fetch favicons, even if Top Sites is disabled

Privacy
1

While inspecting DNS logs, I found that Brave on Android (not tested on other platforms) always makes short connections to various popular websites such as ESPN and Ebay, and they seem to fetch the favicons when opening a new tab. I have disabled the Top Sites feature, but the problem still persists. One way to fix this is to go to Brave Settings>Display>New Tab>Widgets>Show Top Sites and enable the Top Sites feature and then remove the Top Sites by long pressing on the favicons one by one and then disable the Top Sites feature in Brave Settings.

This could be a hidden privacy threat for some people, as it could expose your IP address, user agent, and other http headers, as well as the time you opened a new tab, to popular websites. This issue has been reported to Brave by other people, but there has yet been no response.

Links for more information:

2 Likes
2

I’m no Brave fan, but this kinda sounds like a bug or oversight. Maybe filing a bug report is in order?

1 Like
3

I noticed this years ago when I used Brave and NextDNS. It’s pretty funny that they didn’t fix it yet.

2 Likes
4

Yeah its been an issue for a looooong time. Manually removing the preloaded top sites like you mentioned is the only way to get rid of those connections, kinda stupid that disabling them doesn’t do it.

1 Like
5

Yes, glad you posted this, I previously noticed this myself (Ex. I saw Brave connecting to a Facebook domain…), was super confused but completely forgot about it. Has anyone filed an issue on this yet?

6

This is a known issue to the Brave team since at least October 2020.

Github issue: Add option to disable topsites tracking in Settings · Issue #12263 · brave/brave-browser · GitHub

People complaining about this issue in the Brave forum:
• Disable "top sites" tracking on New Tab Page - Mobile Support - Brave Community
• Why is the brave android browser pinging the following 3rd Party TLD's when the browser is launched each time? - Mobile Support - Brave Community
• Weird Brave Android requests - Misc - Brave Community

1 Like