BrowserAudit - 3 critical problems

[CHEF-KOCH]

Description

Brave Browser is the only Browser (I tested) which has 3 critical security errors/hits. I tested Firefox, Opera, Chrome, Edge & Chromium Edge (Beta) and all of them pass the test.

Steps to reproduce the issue:

1. Visit https://browseraudit.com/test
2. Run the test, which takes a while.
3. You'll see 3 critical hits in the red box, after the test is finished you can review it which says that there are DOM related security problems.
4. Brave Shields settings are set to block ads, block third-party cookies & fingerprinting, HTTPSE is enabled (script blocking is disabled to avoid getting "strange" results).

Actual result:

Expected result:

Brave should not get any critical hit on the test, however I'm not sure how reliable the test page is but since no other of my tested Browser shows a critical hit I think that should be fixed.

Reproduces how often:

Each time you run the test you will see 3 critical flaws.

Brave version (brave://version info)

• Version 0.64.76 Chromium: 74.0.3729.157 (Official Build) (64-bit)
• The issue did not appeared on a build which I tested earlier this year, 12. April - dunno which one it was (sorry).

Version/Channel Information:

• Windows 10 1903 Ent.
• I did not reproduce the issue in any non stable build but I assume the result will be the same.

[diracdeltas]

I tried it on the same version (same shield settings too) but with MacOS instead of windows and got 0 critical issues. do you happen to have any extensions installed?

[yrliou]

Tried on Windows 10 but couldn't reproduce on my end on the same version.

[CHEF-KOCH]

Thanks for the confirmation. Apparently some flags triggering critical problems in the Browser Audit test. E.g. setting #allow-sxg-certs-without-extension to disabled causes one critical error. There are bunch of other settings which might caused my other two critical errors. I already reset all flags now (just in case) and do some further tests.

I was not aware that disabling these flags which are marked with "Enabling this may pose a security risk" are "critical", because that was the reason in the first place why I disabled them.

Theoretically such flags should be removed in order to avoid such problems but I understand that for test reasons etc they are maybe necessary.

[srirambv]

Cant reproduce on Windows

With default shields

With all fingerprint disabled

[diracdeltas]

I was not aware that disabling these flags which are marked with "Enabling this may pose a security risk" are "critical", because that was the reason in the first place why I disabled them.

I wonder if this should be reworded to "setting a non-default setting may pose a security risk." Not sure since we inherited this wording from Chrome