CVE-2025-48980CWE-565

CVE-2025-48980

Medium · published October 31, 2025

CVSS v3.0
6.5
EPSS
0%
Percentile
24.9
In the wild
Unconfirmed
What it is

In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item did not respect the SameSite cookie attribute. Therefore SameSite=Strict cookies would be sent on a cross-site navigation using this method.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00330 · 24.9th percentile
Weakness
CWE-565 · Reliance on Cookies without Validation and Integrity Checking
Published
2025-10-31T04:15Z
References (1)
https://hackerone.com/reports/3253725 · [email protected]
EPSS history
Timeline
  • 30 OCT 23:29Z
    In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item did not respect…
    cvelistv5