CVE-2025-48980

Executive Summary

CVE-2025-48980 is a medium-severity vulnerability in Brave Browser Desktop versions prior to 1.83.10. The flaw resides in the "Open Link in Split View" context menu feature, which fails to respect the SameSite cookie attribute. This allows an attacker to perform a cross-site navigation that sends SameSite=Strict cookies, effectively bypassing the intended SameSite protection. The vulnerability has a CVSS score of 6.5, indicating a moderate risk primarily due to the potential for cookie theft and session hijacking. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, suggesting low exploitation activity in the wild. The vendor, Brave, has released a fix in version 1.83.10.

Supply Chain & Package Security

This vulnerability is specific to the Brave Browser Desktop application, which is a Chromium-based browser. It does not directly affect NPM, PyPI, Go, or Ruby packages. However, the underlying Chromium engine may have similar issues in other browsers, but this CVE is unique to Brave's split view feature.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
• Attack Vector (AV): Network – The attack is executed over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): Required – The victim must use the "Open Link in Split View" context menu.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Sensitive cookies can be exfiltrated.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No impact on availability.

Threat Level: Medium. The vulnerability requires user interaction but can lead to significant data exposure if exploited.

Deep Dive & Mechanics

The SameSite cookie attribute is a security mechanism that controls when cookies are sent with cross-site requests. SameSite=Strict cookies are only sent for same-site requests, preventing CSRF-like attacks. In Brave Browser, the "Open Link in Split View" feature opens a link in a new split pane. Due to a flaw in how this feature handles navigation, it does not enforce the SameSite attribute, causing SameSite=Strict cookies to be sent even when the navigation is cross-site.

Attack Scenario:

1. An attacker hosts a malicious website that contains a link to a target site (e.g., https://bank.com).
2. The victim has an active session on bank.com with SameSite=Strict cookies.
3. The victim right-clicks the link and selects "Open Link in Split View".
4. Brave opens the link in a split pane, sending the SameSite=Strict cookies along with the request.
5. The attacker can then perform actions on behalf of the victim (e.g., transfer funds) if the target site does not have additional CSRF protections.

Vulnerable vs. Patched Code

Vulnerable Code (Brave < 1.83.10): The split view feature likely uses a navigation method that bypasses the SameSite cookie check. In Chromium, the SameSite attribute is enforced at the network layer, but Brave's custom split view implementation may have omitted this check.

// Vulnerable: Navigation without SameSite enforcement
void SplitView::OpenLinkInSplitView(const GURL& url) {
  // Directly navigates without checking SameSite
  web_contents->GetController().LoadURL(url, ...);
}

Patched Code (Brave >= 1.83.10): The fix ensures that the navigation respects the SameSite attribute, likely by using the standard Chromium navigation path that enforces SameSite.

// Patched: Navigation with SameSite enforcement
void SplitView::OpenLinkInSplitView(const GURL& url) {
  // Use standard navigation that respects SameSite
  NavigationController::LoadURLParams params(url);
  params.transition_type = ui::PAGE_TRANSITION_LINK;
  params.is_renderer_initiated = false;
  web_contents->GetController().LoadURLWithParams(params);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Brave Browser Desktop < 1.83.10 with split view enabled.
• A target website that uses SameSite=Strict cookies for authentication.
• A malicious website controlled by the attacker.

Steps:

1. Set up a malicious website that contains a link to the target site (e.g., https://bank.com/transfer?amount=1000&to=attacker).
2. Lure the victim to the malicious site and convince them to right-click the link and select "Open Link in Split View".
3. The request will include the victim's SameSite=Strict cookies, allowing the attacker to perform actions on their behalf.

Lab Setup:

• Use a local Brave instance with an older version.
• Set up a simple HTTP server (e.g., Python) to serve the malicious page.
• Use a test target site with SameSite=Strict cookies.

# malicious_server.py
from http.server import HTTPServer, BaseHTTPRequestHandler

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header('Content-type', 'text/html')
        self.end_headers()
        self.wfile.write(b'''
        <html>
        <body>
        <a href="http://target-site.com/action">Click here, then right-click and open in split view</a>
        </body>
        </html>
        ''')

HTTPServer(('localhost', 8080), Handler).serve_forever()

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual navigation patterns, especially the use of split view with cross-site requests.
• Look for requests that include SameSite=Strict cookies but originate from a different site.

Defense:

• Upgrade Brave Browser to version 1.83.10 or later.
• Disable the split view feature if not needed.
• Implement additional CSRF tokens on sensitive actions.

Indicators of Compromise (IOCs)

• User-Agent: Brave Browser versions < 1.83.10 (e.g., Mozilla/5.0 ... Brave/1.83.9).
• Navigation Pattern: Requests initiated via the split view feature with Sec-Fetch-Site: cross-site and Sec-Fetch-Mode: navigate.
• Cookie Behavior: SameSite=Strict cookies sent in cross-site requests.

Detection Engineering

YARA Rule

rule CVE_2025_48980_Brave_SameSite_Bypass {
    meta:
        description = "Detects Brave Browser versions vulnerable to CVE-2025-48980"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $version = "Brave/" ascii wide nocase
        $split_view = "split_view" ascii wide nocase
    condition:
        $version and $split_view and filesize < 200KB
}

Sigma Rule

title: CVE-2025-48980 Brave SameSite Bypass via Split View
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2025-48980 by monitoring for cross-site requests with SameSite=Strict cookies
author: Valters IT
date: 2025/04/10
logsource:
    category: web
    product: proxy
detection:
    selection:
        Cookie|contains: "SameSite=Strict"
        Referer|contains: "http://"
        RequestMethod: "GET"
    condition: selection
falsepositives:
    - Legitimate use of split view with same-site requests
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-48980 Brave SameSite Bypass"; flow:to_server; content:"Cookie"; nocase; content:"SameSite=Strict"; nocase; http_cookie; pcre:"/^Referer:\s*http:\/\//Hmi"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Brave Browser Desktop to version 1.83.10 or later.
2. Disable the split view feature via brave://flags/#split-view until the update is applied.

Long-term Measures:

• Implement additional CSRF protections (e.g., CSRF tokens) on all sensitive actions.
• Educate users about the risks of using context menu features with untrusted links.
• Monitor for any unusual cookie behavior in web logs.

Patch Details:

• The fix is included in Brave Browser Desktop version 1.83.10, released on [date]. Users should update via the built-in updater or download from the official Brave website.

Valters IT
Securing Digital Frontiers