# SameSite restrictions are lifted, and SameSite:Strict cookie are being sent.

Brave's 'Open Link in Split View' performs cross-site navigation without Sec-Fetch-Site header, so SameSite=Strict cookies are sent, enabling CSRF.

- Payout: hidden
- Severity: high
- Program: Brave Software
- Found by: mingijung
- Disclosed: 2025-10-15
- CVE: CVE-2018-12402, CVE-2022-29912, CVE-2022-45410, CVE-2022-45413, CVE-2023-30674, CVE-2025-48980
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/3253725
- Library page: https://bugbountylibrary.com/r/h1%3A3253725
- Tags: area:os domain:browser impact:integrity kind:bounty platform:hackerone sev:high tech:chromium technique:regression vuln:auth-bypass vuln:csrf

**Target:** Brave browser Split View navigation / cookie SameSite enforcement
**Root cause:** Split View opens cross-site links without attaching the Sec-Fetch-Site: cross-site header, so the browser treats the navigation as same-site and sends SameSite=Strict cookies.
**Steps:**
1. Craft page with `<a href='https://SameSite.check.com' target='_blank'>1234</a>`
2. Left-click link and choose 'Open Link in Split View'
3. Observe request to SameSite.check.com includes SameSite=Strict cookies
4. Compare with 'Open in New Tab' / Incognito where Strict cookies are withheld
**How found:** Researcher compared cookie behavior across link-opening modes (Split View vs New Tab/Incognito) and noticed Strict cookies leaked only in Split View, then traced it to the missing Sec-Fetch-Site header.
**Exploitation:** Attacker lures victim to click a link and select Split View; the cross-site request carries Strict cookies, enabling CSRF against the target site's authenticated endpoints.
**Insight:** Browser UI features that open links (split view, side panels, previews) often skip the navigation metadata (Sec-Fetch-Site) that SameSite enforcement relies on; test each link-opening surface for Strict-cookie leakage.