CVE-2026-32476 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting Brave Conversion Engine (PRO) versions <= 0.8.6. The vulnerability allows remote attackers to inject and execute arbitrary scripts in the context of users interacting with the affected application. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges and requires user interaction, with a scope change and low impact on confidentiality, integrity, and availability.

Successful exploitation could lead to execution of arbitrary scripts in the victim's browser, potentially resulting in session hijacking, defacement, or redirection to malicious sites. The vulnerability impacts confidentiality, integrity, and availability at a low level but is considered high severity due to ease of exploitation and scope change.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution and consider applying any vendor-recommended mitigations once published.