CVE-2021-21323

    Dashboard / Vulnerabilities / CVE-2021-21323

    CVE-2021-21323

    Published: 23 Feb 2021Last Modified: 9 Jul 2026

    Summary:

    Details: Brave is an open source web browser with a focus on privacy and security. In Brave versions 1.17.73-1.20.103, the CNAME adblocking feature added in Brave 1.17.73 accidentally initiated DNS requests that bypassed the Brave Tor proxy. Users with adblocking enabled would leak DNS requests from Tor windows to their DNS provider. (DNS requests that were not initiated by CNAME adblocking would go through Tor as expected.) This is fixed in Brave version 1.20.108

    References: https://github.com/brave/brave-browser/security/advisories/GHSA-mqjf-9x5g-2rv6, https://hackerone.com/reports/1077022, https://github.com/brave/brave-browser/issues/13527, https://github.com/brave/brave-core/commit/12fe321eaad8acc1cbd1d70b4128f687777bcf15, https://github.com/brave/brave-core/pull/7769

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 30d15b9ce70daf1ca2cfc82f1bb84c0751946446
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-21323 | CVE-DB