CVE-2021-22929

Name of the Vulnerable Software and Affected Versions Brave Browser Desktop versions prior to 1.28.62

Description An information disclosure issue exists where logged warning messages include timestamps of connections to V2 onion domains in tor.log. This issue affects versions prior to 1.28.62, where the server connection time for all v2 tor domains is permanently logged to ~/.config/BraveSoftware/Brave-Browser/tor/data/tor.log.

Recommendations For versions prior to 1.28.62, update to version 1.28.62 or later to resolve the issue. As a temporary workaround, consider restricting access to the tor.log file to minimize the risk of information disclosure.