# Brave Browser Tor Window leaks user's real IP to the external DNS server

Brave's Tor window sent DNS queries directly to the local DNS server instead of through the Tor proxy, leaking the user's real IP and visited domains to the ISP.

- Payout: hidden
- Severity: high
- Program: Brave Software
- Found by: newfunction
- Disclosed: 2021-06-17
- CVE: CVE-2021-22917
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1077022
- Library page: https://bugbountylibrary.com/r/h1%3A1077022
- Tags: area:os domain:browser impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:high tech:firefox technique:recon vuln:info-disclosure

**Target:** Brave Tor private window DNS resolution
**Root cause:** DNS resolution in the Tor window bypassed the Tor proxy and used the system resolver directly, so queries went to the ISP's DNS server in cleartext.
**Steps:**
1. Start Wireshark capturing on the internet interface with display filter `dns`.
2. Open Brave and launch a New Private Window with Tor.
3. Navigate to `https://tools.ietf.org/` in the Tor window.
4. Observe a DNS request for `tools.ietf.org` sent to the local DNS server, revealing real IP and domain.
**How found:** Researcher captured traffic with Wireshark while browsing in the Tor window and noticed DNS packets leaving to the system resolver rather than being tunneled.
**Exploitation:** Passive network observer or ISP sees plaintext DNS queries from the user's real IP, correlating identity with visited .onion-adjacent or sensitive domains, defeating Tor anonymity.
**Insight:** When auditing privacy/anonymity modes, capture at the network layer and check every egress path (DNS, OCSP, captive-portal probes, update pings) for leaks outside the tunnel—DNS is the classic bypass.