Security readout for executives and security teams
Plain-English summary
This CVE describes an old Brave browser hang issue. A specially formed long URL created from script could cause Brave versions before 0.14.0 to become unresponsive. The available sources indicate an availability impact, not data theft or code execution. Evidence is limited and no active exploitation is cited.
Executive priority
Treat this as low operational urgency unless legacy Brave is present. The known impact is availability disruption in an outdated browser version, with no source evidence of active exploitation or code execution.
Technical view
Brave before 0.14.0 mishandled a long URL formed through script-based window.location concatenation containing Unicode control characters, resulting in a hang. The CVE record provides no CVSS score, CWE, detailed affected-platform matrix, or vendor advisory beyond the version boundary and HackerOne reference.
Likely exposure
Exposure appears limited to legacy Brave installations before 0.14.0, with Linux mentioned as an example platform. Organizations using managed modern browsers are unlikely to have material exposure, but any unmanaged or embedded legacy Brave deployments should be checked.
Exploitation context
The source bundle does not show KEV listing or active exploitation. A public HackerOne report exists, so the issue was publicly disclosed. The described impact is browser unresponsiveness after processing a crafted script condition, but the sources do not establish broader compromise capability.
Researcher notes
The record is sparse: no CVSS, CWE, CPEs, or full vendor advisory are included. Analysis should stay constrained to Brave before 0.14.0 and availability impact. Do not infer Chromium-wide exposure or modern Brave impact from the provided evidence.
Mitigation direction
- Upgrade Brave installations to 0.14.0 or later.
- Remove or isolate unsupported legacy Brave browser versions.
- Check Brave vendor guidance if maintaining historical or embedded builds.
- Use enterprise browser management to prevent outdated browser execution.
Validation and detection
- Inventory installed Brave versions across managed endpoints.
- Confirm no systems run Brave before 0.14.0.
- Review helpdesk or endpoint logs for recurring Brave hangs.
- Document any legacy exceptions and compensating controls.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-10799 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://hackerone.com/reports/181558CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.