CVE-2026-77115: Unknown Brave

High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them.

Affected products

• Unknown Brave: before 0.8.6 (fixed in 0.8.6)

Published 2026-08-23. Last modified 2026-08-26.