How severe is CVE-2020-8276?

CVE-2020-8276 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2020-8276 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-8276?

CVE-2020-8276 affects Brave. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-8276?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-8276 published?

CVE-2020-8276 was published on 2020-11-09 and last updated on 2026-06-17.

CVE-2020-8276

CVE-2020-8276 is a medium-severity vulnerability in Brave with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-312.

Key facts

Severity: Medium (CVSS 3.x base score 5.5)
CVSS v2: 2.1
EPSS exploit prediction: 0% (33rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-312
Affected product: Brave
Published: 2020-11-09
Last modified: 2026-06-17

Description

The implementation of Brave Desktop's privacy-preserving analytics system (P3A) between 1.1 and 1.18.35 logged the timestamp of when the user last opened an incognito window, including Tor windows. The intended behavior was to log the timestamp for incognito windows excluding Tor windows. Note that if a user has P3A enabled, the timestamp is not sent to Brave's server, but rather a value from:Used in last 24hUsed in last week but not 24hUsed in last 28 days but not weekEver used but not in last 28 daysNever usedThe privacy risk is low because a local attacker with disk access cannot tell if the timestamp corresponds to a Tor window or a non-Tor incognito window.

Frequently asked questions

What is CVE-2020-8276?: The implementation of Brave Desktop's privacy-preserving analytics system (P3A) between 1.1 and 1.18.35 logged the timestamp of when the user last opened an incognito window, including Tor windows. The intended behavior was to log the timestamp for incognito windows excluding Tor windows. Note that if a user has P3A enabled, the timestamp is not sent to Brave's server, but rather a value from:Used in last 24hUsed in last week but not 24hUsed in last 28 days but not weekEver used but not in last 28 daysNever usedThe privacy risk is low because a local attacker with disk access cannot tell if the timestamp corresponds to a Tor window or a non-Tor incognito window.
How severe is CVE-2020-8276?: CVE-2020-8276 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2020-8276 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-8276?: CVE-2020-8276 affects Brave. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-8276?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-8276 published?: CVE-2020-8276 was published on 2020-11-09 and last updated on 2026-06-17.

References

https://hackerone.com/reports/1024668

Affected products (1)

cpe:2.3:a:brave:brave:*:*:*:*:*:*:*:*

More vulnerabilities in Brave

CVE-2021-45884 — High (CVSS 7.5): In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS…
CVE-2022-47934 — Medium (CVSS 6.5): Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a…
CVE-2022-47933 — Medium (CVSS 6.5): Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that…
CVE-2022-47932 — Medium (CVSS 6.5): Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that…
CVE-2018-10799 — Medium (CVSS 6.5): A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux). This vulnerability is caused by the…
CVE-2018-10798 — Medium (CVSS 6.5): A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux). The vulnerability is caused by mishandling…

All CVEs affecting Brave →

Other CWE-312 (Cleartext Storage of Sensitive Information) vulnerabilities

CVE-2022-43757 — Critical (CVSS 9.9): A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain…
CVE-2021-36782 — Critical (CVSS 9.9): A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster…
CVE-2020-9045 — Critical (CVSS 9.9): During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management…
CVE-2026-31848 — Critical (CVSS 9.8): Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which…
CVE-2025-65826 — Critical (CVSS 9.8): The mobile application was found to contain stored credentials for the network it was developed on. If an attacker…
CVE-2025-34206 — Critical (CVSS 9.8): Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) mount host…

Browse all CWE-312 (Cleartext Storage of Sensitive Information) vulnerabilities →