CVE-2025-48980

MediumCVSS 6.5/10Last modified Oct 7, 2026

Description

In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item did not respect the SameSite cookie attribute. Therefore SameSite=Strict cookies would be sent on a cross-site navigation using this method.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-565

Affected software

Vendor	Product	Versions
Brave	Desktop Browser	>= 1.83.10, < 1.83.10

References

https://hackerone.com/reports/3253725

Timeline

Published: Oct 31, 2025
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-489818.6An insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows attackers within the intranet to eavesdrop and mani CVE-2025-489827.8This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator is tricked into rest CVE-2025-489839.9A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructur CVE-2025-489848.8A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.CVE-2025-489855.3A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to byp CVE-2025-489868.8Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email addre CVE-2025-489876.1Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected XSS attack.CVE-2025-489887.5Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 throu CVE-2025-489897.5Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affect CVE-2025-48999.8A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been rated as critical. This issue affects some unknown proces CVE-2025-489908.6NeKernal is a free and open-source operating system stack. Version 0.0.2 has a 1-byte heap overflow in `rt_copy_memory`, which unconditional CVE-2025-489914.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a vulnerability prese