CVE-2022-30334: Brave

Medium severity, CVSS 5.3. EPSS: 2.7% chance of exploitation in the next 30 days.

Brave before 1.34, when a Private Window with Tor Connectivity is used, leaks .onion URLs in Referer and Origin headers. NOTE: although this was fixed by Brave, the Brave documentation still advises "Note that Private Windows with Tor Connectivity in Brave are just regular private windows that use Tor as a proxy. Brave does NOT implement most of the privacy protections from Tor Browser."

Affected products

• Brave Brave: before 1.34 (fixed in 1.34)

Published 2022-05-07. Last modified 2026-06-17.