CVE-2018-1000815

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2018-1000815

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000815.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2018-1000815

Published

2018-12-20T15:29:00.547Z

Modified

2026-04-11T06:58:37.276906Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator

Summary

[none]

Details

Brave Software Inc. Brave version version 0.22.810 to 0.24.0 contains a Other/Unknown vulnerability in function ContentSettingsObserver::AllowScript() in contentsettingsobserver.cc that can result in Websites can run inline JavaScript even if script is blocked, making attackers easier to track users. This attack appear to be exploitable via the victim must visit a specially crafted website. This vulnerability appears to have been fixed in 0.25.2.

References

Affected packages

Git / github.com/brave/muon

Affected ranges

Type: GIT
Repo: https://github.com/brave/muon
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

c18663aa171c6cdf03da3e8c70df8663645b97c4

Type: GIT
Repo: https://github.com/brave/muon
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

c18663aa171c6cdf03da3e8c70df8663645b97c4

Affected versions

v0.*

v0.1.0

v0.1.1

v0.1.2

v0.1.3

v0.1.4

v0.1.5

v0.1.6

v0.1.7

v0.1.8

v0.10.0

v0.10.1

v0.10.2

v0.10.3

v0.10.4

v0.10.5

v0.10.6

v0.10.7

v0.11.0

v0.11.1

v0.11.10

v0.11.2

v0.11.3

v0.11.4

v0.11.5

v0.11.6

v0.11.7

v0.11.8

v0.11.9

v0.12.0

v0.12.1

v0.12.2

v0.12.3

v0.12.4

v0.12.5

v0.12.6

v0.12.7

v0.13.0

v0.13.1

v0.13.2

v0.13.3

v0.14.0

v0.14.1

v0.14.2

v0.14.3

v0.15.0

v0.15.1

v0.15.2

v0.15.3

v0.15.4

v0.15.5

v0.15.6

v0.15.7

v0.15.8

v0.15.9

v0.16.0

v0.16.1

v0.16.2

v0.16.3

v0.17.0

v0.17.1

v0.17.2

v0.18.0

v0.18.1

v0.18.2

v0.19.0

v0.19.1

v0.19.2

v0.19.3

v0.19.4

v0.19.5

v0.2.0

v0.2.1

v0.20.0

v0.20.1

v0.20.2

v0.20.3

v0.20.4

v0.20.5

v0.20.6

v0.20.7

v0.20.8

v0.21.0

v0.21.1

v0.21.2

v0.21.3

v0.22.0

v0.22.1

v0.22.2

v0.22.3

v0.23.0

v0.24.0

v0.25.0

v0.25.1

v0.25.2

v0.25.3

v0.26.0

v0.26.1

v0.27.0

v0.27.1

v0.27.2

v0.27.3

v0.28.0

v0.28.1

v0.28.2

v0.28.3

v0.29.0

v0.29.1

v0.29.2

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.3.4

v0.3.5

v0.30.0

v0.30.1

v0.30.2

v0.30.3

v0.30.4

v0.30.5

v0.31.0

v0.31.1

v0.31.2

v0.32.0

v0.32.1

v0.32.2

v0.32.3

v0.33.0

v0.33.1

v0.33.2

v0.33.3

v0.33.4

v0.33.7

v0.33.8

v0.33.9

v0.34.0

v0.34.1

v0.34.2

v0.34.3

v0.35.0

v0.35.1

v0.35.2

v0.35.3

v0.35.4

v0.36.4

v0.36.6

v0.4.0

v0.4.2

v0.4.3

v0.4.4

v0.4.5

v0.4.6

v0.4.7

v0.4.8

v0.4.9

v0.5.0

v0.5.1

v0.5.2

v0.5.3

v0.5.4

v0.6.0

v0.6.1

v0.6.10

v0.6.11

v0.6.12

v0.6.2

v0.6.3

v0.6.4

v0.6.5

v0.6.6

v0.6.7

v0.6.8

v0.6.9

v0.7.0

v0.7.1

v0.7.2

v0.7.3

v0.7.4

v0.7.5

v0.7.6

v0.8.0

v0.8.1

v0.8.2

v0.8.3

v0.8.4

v0.8.5

v0.8.6

v0.8.7

v0.9.0

v0.9.1

v0.9.2

v0.9.3

v1.*

v1.4.0

v1.4.1

v1.4.10

v1.4.12

v1.4.13

v1.4.14

v1.4.15

v1.4.16

v1.4.17

v1.4.19

v1.4.2

v1.4.20

v1.4.21

v1.4.22

v1.4.23

v1.4.24

v1.4.25

v1.4.3

v1.4.4

v1.4.5

v1.4.6

v1.4.7

v1.4.8

v1.4.9

v2.*

v2.0.10

v2.0.11

v2.0.12

v2.0.13

v2.0.14

v2.0.15

v2.0.17

v2.0.18

v2.0.19

v2.0.2

v2.0.4

v2.0.5

v2.0.7

v2.0.8

v2.56.0

v2.56.2

v2.56.3

v2.56.4

v2.56.5

v2.56.6

v2.56.7

v2.56.8

v2.56.9

v2.57.0

v2.57.10

v2.57.4

v2.57.5

v2.57.6

v2.57.7

v2.57.8

v2.57.9

v2.58.0

v2.58.1

v2.58.2

v2.58.3

v2.58.4

v2.58.6

v2.58.7

v2.58.8

v2.58.9

v3.*

v3.0.100

v4.*

v4.1.8

v4.3.11

v4.3.15

v4.3.20

v4.3.21

v4.4.19

v4.4.27

v4.4.29

v4.5.15

v4.5.6

v4.5.7

v8.*

v8.1.0

v8.1.1

v8.1.2

v8.1.3

v8.1.4

v8.1.5

v8.1.6

v8.1.7

Database specific

vanir_signatures_modified

"2026-04-11T06:58:37Z"

vanir_signatures

[
    {
        "id": "CVE-2018-1000815-49c9cda7",
        "target": {
            "file": "chromium_src/chrome/renderer/content_settings_observer.cc"
        },
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "318093309610250222792426668602367594616",
                "188686536881227790241920583138718717506",
                "276934764488674013129294701370689716713",
                "1083221590764502073355819346452401583",
                "198922042852065480913029450281054197803",
                "294800648861777450277444423769748436107",
                "314401719051759229242870033660141259098",
                "225886529903821946490248478387264707715"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "source": "https://github.com/brave/muon/commit/c18663aa171c6cdf03da3e8c70df8663645b97c4",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2018-1000815-5af47da3",
        "target": {
            "file": "chromium_src/chrome/renderer/content_settings_observer.cc",
            "function": "ContentSettingsObserver::AllowScript"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "101297697594350008152047321738232744166",
            "length": 695.0
        },
        "signature_type": "Function",
        "source": "https://github.com/brave/muon/commit/c18663aa171c6cdf03da3e8c70df8663645b97c4",
        "signature_version": "v1"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000815.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0.22.810"
            },
            {
                "last_affected": "0.24.0"
            }
        ]
    }
]