Live › vulnerability › CVE-2026-48202
The Brave brave-popup-builder plugin does not neutralize script-related HTML tags in a web page, allowing code injection. An attacker who can supply input the plugin renders can run JavaScript in a visitor's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Sites running the Brave popup builder plugin at version 0.8.8 or earlier are in scope, since the flaw is in how the plugin renders HTML. The sources do not say which input path is exploitable or whether admin access is needed, so treat any site with the plugin installed as potentially exposed. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
brave-popup-builder in the site's plugin directory.0.8.8 are affected; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brave: from n/a through 0.8.8.
This page as .md · .json · in your agent: get_signal("CVE-2026-48202")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.