CVE-2016-10718

HIGH

Brave Browser < 0.13.0 - Denial of Service via Tab Closure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-10718. PoCs published by Sahil Tikoo.

AI-analyzed exploit summary This exploit demonstrates a Denial of Service (DoS) vulnerability in Brave Browser versions prior to 0.13.0 by triggering excessive resource consumption via a JavaScript window.close(self) call. The PoC is a simple HTML page that, when clicked, executes the malicious JavaScript to crash the browser.

Description

Brave Browser before 0.13.0 allows a tab to close itself even if the tab was not opened by a script, resulting in denial of service.

Exploits (1)

exploitdb WORKING POC
by Sahil Tikoo · textdoswindows
https://www.exploit-db.com/exploits/44475

This exploit demonstrates a Denial of Service (DoS) vulnerability in Brave Browser versions prior to 0.13.0 by triggering excessive resource consumption via a JavaScript window.close(self) call. The PoC is a simple HTML page that, when clicked, executes the malicious JavaScript to crash the browser.

Classification
Working Poc 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Brave Browser < 0.13.0
No auth needed
Prerequisites: Victim must visit the malicious HTML page and click the link
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/44475/
Third Party Advisory x_refsource_confirm
https://github.com/brave/browser-laptop/issues/5007
Third Party Advisory x_refsource_confirm
https://hackerone.com/reports/176197
Third Party Advisory x_refsource_confirm
https://github.com/brave/browser-laptop/issues/5006

Scores

CVSS v3 7.5
EPSS 0.1289
EPSS Percentile 95.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-20
Status published
Products (1)
brave/brave_browser < 0.13.0
Published Apr 04, 2018
Tracked Since Feb 18, 2026