The following versions of Leef Browser currently receive security updates:

We take security seriously. If you discover a vulnerability in Leef Browser, please do not open a public GitHub issue.

Instead, report it privately so we can address it before public disclosure:

• Email: contact.qtech@proton.me
• GitHub: Use GitHub's private vulnerability reporting on this repository

Please provide as much detail as possible:

1. A description of the vulnerability and its potential impact
2. Steps to reproduce the issue
3. The Leef Browser version affected
4. Any proof-of-concept code or screenshots (if applicable)

• Remote code execution via the browser
• Sandbox escape from Electron's renderer process
• Authentication/session vulnerabilities
• Data exfiltration via the browser's network layer

• Issues in websites visited through Leef (not the browser itself)
• Missing security headers on third-party sites
• Denial of service requiring physical access

Leef Browser is built on Electron and uses the following security configuration:

• webSecurity: true — enforces same-origin policy in webviews
• contextIsolation: false / nodeIntegration: true — required for the current renderer architecture; a future update will migrate to a preload-based IPC model
• All network-level ad/tracker blocking is handled in the main process via session.webRequest
• No external analytics or telemetry is collected

Leef Browser is developed by QTech.