Brave Shields Domain Reordering Leads to Origin Confusion

Violation of Secure Design Principles (CWE-657)CVSS 2.5€94

mousepadkalilinux12

Disclosed on HackerOne · April 13, 2026

2 min 12

Publicly disclosed report · by mousepadkalilinux12

Summary:

brave shields shows the domain like 1.attacker.com as attacker.com.1

steps to reproduced

go to brave browser ( currently i am using ubuntu as os and browser version is Brave 1.89.132 (Official Build) (64-bit) Chromium: 147.0.7727.56
go to 1.1.1.1.attacker.com
click on brave shield and you can see that the site name changed to attacker.com.1.1.1.1

You must be logged in to read this writeup. Join our community of researchers today.