CVE-2025-48980 Overview
CVE-2025-48980 is a cookie handling flaw in Brave Browser Desktop versions prior to 1.83.10 when the split view feature is enabled. The "Open Link in Split View" context menu item does not respect the SameSite cookie attribute. As a result, cookies configured with SameSite=Strict are transmitted on cross-site navigations initiated through this menu option. The issue is classified under [CWE-565: Reliance on Cookies without Validation and Integrity Checking].
Critical Impact
Attackers who convince a user to open a crafted link via split view can trigger authenticated cross-site requests, undermining the primary defense that SameSite=Strict provides against cross-site request forgery and tracking.
Affected Products
- Brave Browser Desktop versions prior to 1.83.10
- Installations with the split view feature enabled
- Cross-platform desktop builds (Windows, macOS, Linux)
Discovery Timeline
- 2025-10-31 - CVE-2025-48980 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-48980
Vulnerability Analysis
The vulnerability resides in the context menu handler that services the "Open Link in Split View" action. When a user selects this option, Brave opens the target URL alongside the current page. The navigation path bypasses the enforcement logic that evaluates the SameSite cookie attribute for cross-site requests.
Cookies marked SameSite=Strict are designed to travel only when the request originates from the same registrable domain as the target. This restriction is a core browser defense against cross-site request forgery (CSRF) and cross-site tracking. In vulnerable builds, the split view navigation is treated as a first-party context, so strict cookies attach to the outgoing request even when the source and destination sites differ.
Root Cause
The root cause is missing site-context propagation in the split view navigation code path. The handler constructs the new tab request without carrying the initiator origin needed for SameSite enforcement. The cookie store then defaults to sending all matching cookies, including those explicitly restricted to strict same-site behavior.
Attack Vector
Exploitation requires user interaction. An attacker must lure a target to a page that presents a link and social-engineer them into choosing "Open Link in Split View" from the context menu. Once selected, the browser navigates to the attacker-controlled or attacker-chosen destination and transmits the user's SameSite=Strict cookies for that destination. This enables authenticated actions on sensitive endpoints that rely on strict cookies as their sole CSRF defense.
For complete technical details, see the HackerOne Security Report #3253725.
Detection Methods for CVE-2025-48980
Indicators of Compromise
- Outbound requests to sensitive web applications carrying session cookies where the Referer or Sec-Fetch-Site header indicates a cross-site origin.
- Brave Browser process versions below 1.83.10 reported in endpoint software inventories.
- Web application logs showing authenticated actions immediately following a cross-site referral.
Detection Strategies
- Inventory installed Brave Browser versions across managed endpoints and flag any release earlier than 1.83.10.
- Instrument sensitive server endpoints to log the Sec-Fetch-Site header and alert when strict-cookie requests arrive with a cross-site value.
- Correlate browser telemetry with web proxy logs to identify unexpected cross-site navigations from Brave clients.
Monitoring Recommendations
- Track Brave update compliance through endpoint management dashboards and enforce minimum version policies.
- Monitor for phishing pages that instruct users to right-click and select context menu items, a common precursor to this exploitation pattern.
- Review web application access logs for authenticated requests lacking the expected same-site Referer.
How to Mitigate CVE-2025-48980
Immediate Actions Required
- Upgrade all Brave Browser Desktop installations to version 1.83.10 or later.
- Verify the update through Brave's built-in updater at brave://settings/help and confirm the installed version.
- Communicate the risk of context-menu-based social engineering to end users.
Patch Information
Brave Software addressed the issue in Brave Browser Desktop version 1.83.10. The fix ensures that navigations initiated by the "Open Link in Split View" context menu item honor the SameSite cookie attribute. Refer to the HackerOne Security Report #3253725 for the disclosure record.
Workarounds
- Disable the split view feature until the browser is updated to 1.83.10 or later.
- Avoid using the "Open Link in Split View" context menu option on untrusted pages.
- Configure sensitive web applications to require additional CSRF tokens rather than relying solely on SameSite=Strict cookies.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
