Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-47934: Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This is caused by a...

CVE-2022-47934 · published 3 years ago

Summary

Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This is caused by an incomplete fix for CVE-2022-47932 and CVE-2022-47934.

What to do

Update brave brave to version 1.43.88 or later.

Affected software

Vendor	Product	Affected versions
brave	brave	< 1.43.88 `cpe:2.3:a:brave:brave::::::::`

Original advisory text

References

https://github.com/brave/brave-browser/issues/24211 Third Party Advisory
https://github.com/brave/brave-browser/issues/25106 Third Party Advisory
https://github.com/brave/brave-core/pull/14313 Patch
https://hackerone.com/reports/1646204 URL
https://github.com/brave/brave-core/commit/82d8e39043e691e0492519126437275511ee8... Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/47xxx/CVE-2022-47934... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-47934 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-400Uncontrolled Resource Consumption

Timeline

Published24 Dec 2022

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2022-47934 · NVD

CVE-2022-47934 · OSV

Track software like this

Free during beta