CVE-2024-37406

Executive Summary

CVE-2024-37406 is a UI redressing / domain confusion vulnerability affecting the Brave Android browser prior to version 1.67.116. The flaw resides in the Brave Shields popup, where domain names are elided (truncated) from the right side instead of the left. This misalignment can cause a user to misidentify the actual domain they are interacting with, potentially leading to phishing or social engineering attacks. The vulnerability has a CVSS score of 0.0 (unscored) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code has been released.

Supply Chain & Package Security

This vulnerability is specific to the Brave Android application, which is distributed via the Google Play Store and Brave’s own APK distribution channels. There is no NPM, PyPI, Go, or Ruby package component. The risk is limited to end-users of the Brave browser on Android devices.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector (AV): Network (N) – The vulnerability is triggered by visiting a malicious website.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – User must view the Brave Shields popup.
• Scope (S): Unchanged (U) – The vulnerable component is the browser itself.
• Confidentiality (C): None (N) – No direct data exposure.
• Integrity (I): Low (L) – Could mislead user into trusting a wrong domain.
• Availability (A): None (N) – No denial of service.

Threat Level: Low (due to low EPSS and no public exploit).

Deep Dive & Mechanics

The Brave Shields popup displays the domain of the currently visited website. In vulnerable versions, when the domain name is too long to fit in the popup, it is truncated (elided) from the right side. For example, a domain like www.attacker-controlled-site.com might be displayed as www.attacker-contr... instead of ...acker-controlled-site.com. This means the user sees the beginning of the domain, which could be crafted to mimic a legitimate site (e.g., www.bankofamerica...). The user may then believe they are on a trusted site when they are actually on a malicious one.

The fix in v1.67.116 changes the elision to truncate from the left, showing the end of the domain (e.g., ...acker-controlled-site.com), which is more secure because the TLD and main domain are visible.

Vulnerable vs. Patched Code

Vulnerable (prior to v1.67.116):

// Example pseudocode for vulnerable behavior
String domain = "www.attacker-controlled-site.com";
int maxLength = 20;
if (domain.length() > maxLength) {
    domain = domain.substring(0, maxLength - 3) + "...";
}
// Result: "www.attacker-contr..."

Patched (v1.67.116+):

// Example pseudocode for patched behavior
String domain = "www.attacker-controlled-site.com";
int maxLength = 20;
if (domain.length() > maxLength) {
    domain = "..." + domain.substring(domain.length() - maxLength + 3);
}
// Result: "...acker-controlled-site.com"

Exploitation & Lab Setup

Red Team

Attack Scenario:

1. Register a domain that starts with a trusted brand name (e.g., bankofamerica-phish.com).
2. Host a phishing page that mimics the legitimate site.
3. Lure the victim to visit the malicious site using social engineering.
4. When the victim opens the Brave Shields popup, they see bankofamerica-phish... and may believe they are on bankofamerica.com.
5. The victim may then enter credentials or sensitive data.

Lab Setup:

• Use a rooted Android device or emulator running Brave Android < v1.67.116.
• Set up a local web server (e.g., Apache/Nginx) with a domain like paypal-verify.com.
• Create a simple HTML page that mimics PayPal login.
• Use a tool like ngrok to expose the local server.
• Send a phishing link to the victim device.

Blue Team

Detection:

• Monitor for unusual domain patterns in browser logs (e.g., domains starting with known brand names but having extra characters).
• Use network monitoring to detect connections to suspicious domains that mimic legitimate sites.
• Educate users to always check the full URL in the address bar, not just the Shields popup.

Hunting:

• Search for browser history entries where the domain in the Shields popup differs from the actual URL.
• Look for user reports of unexpected domain truncation.

Indicators of Compromise (IOCs)

• Domain patterns: Domains that start with a well-known brand name followed by hyphens or extra characters (e.g., google-verify.com, facebook-login.net).
• User agent: Brave Android versions < 1.67.116.
• Network traffic: HTTP/HTTPS requests to domains with suspicious truncation behavior.

Detection Engineering

YARA Rule

rule CVE_2024_37406_Brave_Android_Domain_Elision {
    meta:
        description = "Detects vulnerable Brave Android versions based on domain elision behavior"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37406"
    strings:
        $vuln_elision = /[a-zA-Z0-9.-]{20,}\.\.\./  // domain ending with ... after 20+ chars
        $brave_ua = "Brave" nocase
        $android_ua = "Android" nocase
    condition:
        $brave_ua and $android_ua and #vuln_elision > 0
}

Sigma Rule

title: CVE-2024-37406 - Brave Android Domain Elision Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2024-37406 by monitoring for domains with right-side elision in Brave Android.
author: Valters IT
date: 2025-04-10
logsource:
    category: browser
    product: brave
detection:
    selection:
        UserAgent|contains: 'Brave'
        UserAgent|contains: 'Android'
        Domain|re: '^[a-zA-Z0-9.-]{20,}\.\.\.$'
    condition: selection
falsepositives:
    - Legitimate long domains that are truncated
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-37406 - Brave Android Domain Elision"; flow:to_server; content:"Brave"; http_user_agent; content:"Android"; http_user_agent; pcre:"/^[a-zA-Z0-9.-]{20,}\.\.\.$/U"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Update Brave Android to version 1.67.116 or later via Google Play Store or Brave’s official APK.
• If update is not possible, advise users to avoid using the Brave Shields popup for domain verification and instead rely on the address bar.

Long-term:

• Implement UI testing for domain truncation behavior in all browser components.
• Add a security warning when domain truncation occurs.
• Consider using a more secure truncation method (e.g., showing the last 20 characters).

Workaround:

• Users can disable the Brave Shields popup or use a different browser until patched.

Valters IT
Securing Digital Frontiers