CVE-2021-21323: Regression in DNS leakage from Tor windows

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-23 · updated 2026-06-17
Weakness: CWE-200

Description

Brave is an open source web browser with a focus on privacy and security. In Brave versions 1.17.73-1.20.103, the CNAME adblocking feature added in Brave 1.17.73 accidentally initiated DNS requests that bypassed the Brave Tor proxy. Users with adblocking enabled would leak DNS requests from Tor windows to their DNS provider. (DNS requests that were not initiated by CNAME adblocking would go through Tor as expected.) This is fixed in Brave version 1.20.108

Affected products

https://github.com/brave/brave-core: from 1.17.73 through 1.20.103

References

https://github.com/brave/brave-browser/issues/13527
https://github.com/brave/brave-browser/security/advisories/GHSA-mqjf-9x5g-2rv6
https://github.com/brave/brave-core/commit/12fe321eaad8acc1cbd1d70b4128f687777bcf15
https://github.com/brave/brave-core/pull/7769
https://hackerone.com/reports/1077022
https://github.com/brave/brave-browser/issues/13527
https://github.com/brave/brave-browser/security/advisories/GHSA-mqjf-9x5g-2rv6
https://github.com/brave/brave-core/commit/12fe321eaad8acc1cbd1d70b4128f687777bcf15
https://github.com/brave/brave-core/pull/7769
https://hackerone.com/reports/1077022

Get alerted when CVE-2021-21323 or the next vulnerability affects your stack