CVE-2025-23086

Executive Summary

CVE-2025-23086 is a UI spoofing vulnerability affecting Brave Browser versions 1.70.x through 1.73.x on desktop platforms. The vulnerability resides in a feature that displays the requesting site's origin on the OS-provided file selector dialog when a site prompts the user to upload or download a file. Due to incorrect origin inference in certain edge cases, a malicious site can combine this flaw with an open redirector vulnerability on a trusted site to spoof the origin displayed in the file selector dialog. This makes the download or upload request appear to originate from the trusted site, potentially tricking users into accepting a file from an untrusted source.

The CVSS score is 0.0 (NVD default), but the actual risk is moderate due to the requirement for a secondary open redirector vulnerability and user interaction. The attack chain is complex but plausible in targeted phishing scenarios.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a client-side browser vulnerability specific to the Brave Browser application.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is initiated over the network.
• Attack Complexity (AC): High (H) – Requires a secondary open redirector vulnerability on a trusted site.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The user must interact with the file selector dialog.
• Scope (S): Unchanged (U) – The vulnerable component is the browser itself.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – The user may be tricked into downloading a malicious file.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (Exploitation requires chaining with an open redirector and user interaction).

Deep Dive & Mechanics

The vulnerability is rooted in Brave's implementation of the file selector dialog origin display feature. When a website triggers a file upload or download, Brave attempts to extract the origin from the request context to display it in the OS-native dialog. The flaw occurs when the origin is inferred from an intermediate redirect rather than the final request source.

Attack Chain:

1. The attacker hosts a malicious site (e.g., evil.com).
2. The attacker identifies a trusted site (e.g., trusted.com) with an open redirector vulnerability (e.g., trusted.com/redirect?url=evil.com).
3. The malicious site initiates a file download/upload request via the open redirector, causing the browser to follow the redirect to evil.com.
4. Brave incorrectly infers the origin as trusted.com (the redirector) instead of evil.com (the final source).
5. The file selector dialog displays "trusted.com wants to download a file," tricking the user into accepting the download.

Root Cause: The origin inference logic does not account for HTTP redirects, specifically when the redirect chain involves a trusted domain.

Vulnerable vs. Patched Code

Vulnerable Code (Brave 1.70.x-1.73.x):

// Simplified origin inference logic
std::string GetOriginForFileDialog(const GURL& request_url) {
    // Directly uses the request URL's origin without checking redirect chain
    return request_url.GetOrigin().spec();
}

Patched Code (Hypothetical fix):

// Patched origin inference logic
std::string GetOriginForFileDialog(const GURL& request_url, const std::vector<GURL>& redirect_chain) {
    // Use the last URL in the redirect chain (the actual source)
    GURL final_url = redirect_chain.empty() ? request_url : redirect_chain.back();
    return final_url.GetOrigin().spec();
}

The patch ensures that the origin is derived from the final URL in the redirect chain, not the initial request URL.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A trusted site with an open redirector (e.g., trusted.com/redirect?url=evil.com).
• A malicious site (evil.com) that triggers a file download.

Exploitation Steps:

1. Host a malicious file on evil.com (e.g., malware.exe).
2. Craft a link that uses the open redirector: trusted.com/redirect?url=evil.com/download.
3. Lure the victim to click the link (e.g., via phishing email).
4. The victim's Brave browser (v1.70-1.73) will display a file selector dialog showing "trusted.com wants to download a file."
5. The victim, trusting trusted.com, accepts the download.

Proof of Concept (HTML):

<!DOCTYPE html>
<html>
<body>
    <a href="https://trusted.com/redirect?url=https://evil.com/malware.exe">Click here for a free gift!</a>
</body>
</html>

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual file download patterns from trusted sites that have open redirectors.
• Use browser logs to detect redirect chains involving known open redirectors.

Defense:

• Apply browser updates as soon as a patch is released.
• Implement Content Security Policy (CSP) headers to restrict open redirectors.
• Educate users to verify the origin in file selector dialogs, especially when redirected.

Indicators of Compromise (IOCs)

• Network: HTTP redirect chains where the initial request is to a trusted domain and the final request is to an untrusted domain.
• File: Unexpected executable files (.exe, .scr, .bat) downloaded from trusted-looking origins.
• Behavior: File selector dialog showing a trusted origin but the actual download source is different.

Example IOC (Suricata rule trigger):

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Potential CVE-2025-23086 exploitation"; flow:to_server; content:"trusted.com/redirect"; nocase; sid:1000001; rev:1;)

Detection Engineering

YARA Rule

rule CVE_2025_23086_Brave_FileDialog_Spoof {
    meta:
        description = "Detects Brave Browser versions vulnerable to CVE-2025-23086"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-23086"
    strings:
        $version_70 = "Brave 1.70" nocase
        $version_71 = "Brave 1.71" nocase
        $version_72 = "Brave 1.72" nocase
        $version_73 = "Brave 1.73" nocase
    condition:
        any of ($version_*) and filesize < 10MB
}

Sigma Rule

title: CVE-2025-23086 - Brave Browser File Dialog Origin Spoofing
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of CVE-2025-23086 via open redirectors
author: Valters IT
date: 2025-04-10
logsource:
    category: proxy
    product: generic
detection:
    selection:
        http.url|contains: "/redirect?url="
        http.referer|contains: "trusted.com"
    condition: selection
falsepositives:
    - Legitimate use of open redirectors
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-23086 - Brave File Dialog Spoofing via Open Redirect"; flow:to_server; content:"/redirect?url="; nocase; http_uri; pcre:"/^https?:\/\/[^\/]+\/redirect\?url=https?:\/\//Ui"; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Brave Browser: Upgrade to version 1.74.x or later once a patch is released.
2. Disable the Feature: If possible, disable the origin display feature in Brave settings (if configurable).
3. Monitor Open Redirectors: Audit trusted sites for open redirector vulnerabilities and fix them.

Long-term Fix:

• Brave developers should patch the origin inference logic to consider the full redirect chain.

Workaround:

• Use a different browser (e.g., Chrome, Firefox) until a patch is available.

Valters IT
DevSecOps & Cyber Threat Intelligence