CVE-2026-77115: CWE-79 Cross-Site Scripting (XSS) in Brave

Brave Popup Builder (brave-popup-builder) versions before 0.8.6 improperly handle UTM query parameters by reflecting them into popup form HTML without escaping, leading to a CWE-79 Cross-Site Scripting vulnerability. This can allow an attacker to inject malicious scripts via crafted UTM parameters. The CVSS v3.1 score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at low levels.

Successful exploitation could lead to execution of arbitrary scripts in the context of the affected application, potentially resulting in information disclosure, modification of data, or disruption of service. The vulnerability affects confidentiality, integrity, and availability at low levels. No known active exploitation has been reported.

No official patch or remediation level has been published by the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with UTM parameters and consider implementing input validation or escaping as a temporary mitigation if possible.