# How I found a Tor vulnerability in Brave Browser, reported it, watched it get patched, got a CVE (CVE-2020-8276) and a small bounty, all in one working day

Brave logged Tor incognito session timestamps in Local State and sent X-Brave-Partner headers during Tor, enabling de-anonymization of Tor users.

- Payout: $100
- Severity: low
- Program: Brave Software
- Found by: sickcodes (@sickcodes)
- Disclosed: 2020-11-05
- CVE: CVE-2020-8276
- Write-up quality: 6/10
- Original: https://community.disclose.io/t/how-i-found-a-tor-vulnerability-in-brave-browser-reported-it-watched-it-get-patched-got-a-cve-cve-2020-8276-and-a-small-bounty-all-in-one-working-day/65
- Library page: https://bugbountylibrary.com/r/blog%3Acommunity-disclose-io-t-how-i-found-a-tor-vulnerability-in-brave-browser-reported-it-watched-it-get-patched-got-a-cve-cv
- Tags: area:os domain:browser domain:desktop impact:data-leak impact:pii-leak kind:bounty platform:blog sev:low technique:source-review vuln:info-disclosure

**Target:** Brave browser Local State JSON and Tor profile metrics
**Root cause:** Brave's P3A metrics logged the incognito-used timestamp for any incognito profile, including Tor profiles, and persisted Tor session data without clearing it on exit.
**Steps:**
1. Enable Private Window with Tor in brave://settings.
2. Open a Tor window and visit a Brave partner site such as coinbase.com.
3. Observe the request includes `x-brave-partner: coinbase` even under Tor.
4. Inspect `~/.config/BraveSoftware/Brave-Browser/Local State` and find `tor_used: true`, `referral_attempt_count`, `referral_attempt_timestamp`, `incognito_used_timestamp`, `last_used: Tor Profile`.
5. Exit the Tor session and confirm the `~/.config/BraveSoftware/Brave-Browser/tor/data/` folder (keys, state, tor.log) is not cleared.
**How found:** Noticed Brave injects X-Brave-Partner referral headers; wondered if they appear in Tor sessions, confirmed they do, then explored the Tor data folder and Local State JSON, finding persistent Tor timestamps and uncleared session files.
**Exploitation:** An attacker with local disk access (e.g. seized device) reads Local State and tor/data to determine with nanosecond accuracy when Tor was last used, correlating with ISP records to de-anonymize the user.
**Insight:** Privacy features like Tor/incognito are high-value targets: check whether referral/monetization headers and metrics logging still fire inside them, and whether session artifacts persist on disk after exit.

## Proof of concept (copied exactly from the original report)

**Tor session request leaking x-brave-partner header**

```
curl 'https://www.coinbase.com/' \
 -H 'authority: www.coinbase.com' \
 -H 'pragma: no-cache' \
 -H 'cache-control: no-cache' \
 -H 'dnt: 1' \
 -H 'upgrade-insecure-requests: 1' \
 -H 'user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36' \
 -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' \
 -H 'x-brave-partner: coinbase' \
 -H 'sec-fetch-site: none' \
 -H 'sec-fetch-mode: navigate' \
 -H 'sec-fetch-user: ?1' \
 -H 'sec-fetch-dest: document' \
 -H 'accept-language: en-US,en;q=0.9' \
 -H 'sec-gpc: 1' \
 --compressed


As you can see, Brave inserts the header:

 -H 'x-brave-partner: coinbase' \


Obviously Brave has to make money. But I immediately wanted to see if it showed up on Tor sessions.

To enable the Tor feature, you need to visit brave://settings/?search=tor, or just go to settings in the menu.

Enable this:

Private Window with Tor

Tor hides your IP address from the sites you visit.

Once enabled, you can open Tor windows in the menu bar:

open-tor-window-brave.png

As Tor Project users will understand, there are a number of obvious issues while using Tor outside of the original Tor Browser.

The list of ongoing leakproofing issues for the Brave Tor experience can be found in the Brave Core git issues: GitHub · Where software is built

Tor browser users know about the window size fingerprinting technique, which already has an issue opened for the Brave rendition of Tor: [hackerone] fix tor window size fingerprinting · Issue #9341 · brave/brave-browser · GitHub

To answer the question above, yes, Brave sends the “x-brave-partner: coinbase” header when visiting the coinbase website.

Even when Tor is on:

curl 'https://www.coinbase.com/' \
 -H 'authority: www.coinbase.com' \
 -H 'pragma: no-cache' \
 -H 'cache-control: no-cache' \
 -H 'dnt: 1' \
 -H 'upgrade-insecure-requests: 1' \
 -H 'user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36' \
 -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' \
 -H 'x-brave-partner: coinbase' \
 -H 'sec-fetch-site: none' \
 -H 'sec-fetch-mode: navigate' \
 -H 'sec-fetch-user: ?1' \
 -H 'sec-fetch-dest: document' \
 -H 'accept-language: en-US,en;q=0.9' \
 --compressed
```

**Tor data folder files left on disk**

```
~/.config/BraveSoftware/Brave-Browser/tor/data/keys
~/.config/BraveSoftware/Brave-Browser/tor/data/state
~/.config/BraveSoftware/Brave-Browser/tor/data/tor.log
~/.config/BraveSoftware/Brave-Browser/tor/data/cached-microdescs.new
~/.config/BraveSoftware/Brave-Browser/tor/data/cached-microdesc-consensus
~/.config/BraveSoftware/Brave-Browser/tor/data/cached-certs
~/.config/BraveSoftware/Brave-Browser/tor/data/lock
```

**Patch excluding Tor profile from incognito timestamp**

```
const char* GetPrefNameForProfile(Profile* profile) {
- if (profile->IsIncognitoProfile()) {
+ if (profile->IsIncognitoProfile() &&
+ !brave::IsTorProfile(profile)) {
 return kLastTimeIncognitoUsed;
 }
 return nullptr;
```