Brave Browser CVE-2025-48980

Exploitation requires three concrete conditions drawn from the description: (1) the Brave Browser desktop version must be prior to 1.83.10; (2) the 'split view' feature must be enabled (a specific, non-default Brave feature, not a standard browser capability); and (3) the victim must manually invoke the 'Open Link in Split View' context-menu item on an attacker-influenced link - this is the exact user interaction reflected by UI:R. These factors sharply limit realistic exploitation: it cannot be triggered silently or automatically, it depends on an opt-in feature being active, and it requires a deliberate right-click action by the target, so it is unsuitable for drive-by or mass exploitation.

This is a moderate-severity browser privacy flaw, not a priority emergency. The NVD CVSS 3.0 vector (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5) marks it network-exploitable with no privileges but requiring user interaction and causing confidentiality-only impact. The C:H rating appears inflated for what the description actually describes - a single SameSite=Strict cookie being transmitted on one specific cross-site navigation path - so the real confidentiality impact is closer to Low than High; verify scope with Brave. Supporting signals point to low real-world urgency: EPSS is 0.33% (24th percentile), there is no CISA KEV listing, and no public exploit code was identified (the sole reference is a HackerOne report, which is a vulnerability submission, not published POC). No SSVC decision data was provided. The signals are consistent with each other: a legitimately-reported, responsibly-disclosed browser edge case with a narrow trigger (split view must be enabled AND the victim must manually choose the context-menu action), not evidence of active or automatable exploitation. Patch (1.83.10) is the clear remediation.

A user who has Brave's split view feature enabled right-clicks an attacker-supplied link and selects 'Open Link in Split View'; because this path ignores the SameSite=Strict attribute, the victim's strict cookies for the target site are transmitted on what is effectively a cross-site navigation, potentially enabling CSRF-style actions or state leakage against the authenticated site. No public exploit code was identified at time of analysis, and the attack depends on the victim performing the specific context-menu interaction.