CVE-2021-22916

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

In Brave Desktop between versions 1.17 and 1.26.60, when adblocking is enabled and a proxy browser extension is installed, the CNAME adblocking feature issues DNS requests that used the system DNS settings instead of the extension's proxy settings, resulting in possible information disclosure.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	https://github.com/brave/brave-core	Fixed in 1.26.60

References

https://hackerone.com/reports/1203842Third Party Advisory
https://hackerone.com/reports/1203842Third Party Advisory

Timeline

Published: Jul 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-229176.5Brave Browser Desktop between versions 1.17 and 1.20 is vulnerable to information disclosure by way of DNS requests in Tor windows not flowi CVE-2021-229185.3Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. CVE-2021-229197.5A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway)CVE-2021-22928.1Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Document Management). Suppo CVE-2021-229206.5A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway)CVE-2021-229217.8Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platform CVE-2021-229226.5When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML CVE-2021-229235.3When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, CVE-2021-229243.7libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to err CVE-2021-229255.3curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=con CVE-2021-229267.5libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` optio CVE-2021-229278.1A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow a