Leaking IPs in Brave Tor Window & Chrome VPNs + Popunders + CSP Bypass (fixed)

General
,
1

Fortunately, an upstream fix was submitted by Brave’s security team which led to both of these Web APIs to be fixed in Chromium relatively quickly. (#6249551 & #6269498)

There is one more way through which I was able to achieve the same impact (Leaking the user’s real IP address to a remote host behind Chrome VPN Extensions/Brave’s Tor window) which is unrelated to the BackgroundFetch/WebAuthn APIs. However that issue has yet to be fully resolved by all affected vendors, so sadly, I am not allowed to disclose it for now.

2

Not surprised at seeking bugs like this. Brave with Tor never made much sense to me in the first place.

I can’t think of a reason of using it, but of course anyone can enlighten me on why :laughing:

5 Likes
3

Additionally, Chromium has security advantages over Gecko

1 Like