I’m extremely disappointed with what I’ve just experienced using Brave on a public Wi-Fi network.
Today, I discovered that my browser was automatically casting to a nearby smart TV without my consent—and I only realized it because I happened to click the cast icon which is the note icon in the upper-right corner of the browser. There was no prompt, no warning, and no visible notification that Brave had connected to a device on the network.
Here’s what happened:
I didn’t even know the browser had this casting feature.
The browser connected to a TV without my permission, which seriously undermines my confidence in its privacy and security.
The smart TV was playing YouTube, and I could control playback (seek, pause, etc.) from Brave—even though I wasn’t watching YouTube at all.
When I clicked “Stop casting,” the browser would reconnect automatically, without asking me.
I have a video recording of this behavior.
This is honestly unacceptable. Brave claims to put privacy first, yet this media router feature is enabled by default, and it can lead to serious privacy breaches just like this. I’m frustrated and genuinely concerned.
I need to know:
Was any part of my screen, tabs, or activity shared with the TV during this process?
Or was Brave just acting as a controller for an existing YouTube session on the TV?
I’ve been using this network for months, and I only found out about this today. I can’t believe something like this can happen silently in a browser that brands itself around user privacy. Honestly, this feels like a huge oversight.
I’ve been controlling their TV for around 5 minutes, and when I recorded the video, that was the moment they turned the TV off. But before that, I kept trying to click “Stop casting,” and it would always reconnect to their TV automatically.
The Media Router can be disabled by visiting brave://settings/extensions.
Note, the casting option is provided in the bottom-right corner of the Youtube video and is required to connect to a TV. The browser will not connect to a TV without turning it on within the video player or from the Cast option in the browser toolbar. Closing the Youtube window will not stop the cast. So, if you see a cast still appear it is likely from a previously closed window.
Privacy concerns related to the Media Router were addressed in the issue below.
The SSDP (Simple Service Discovery Protocol) requests are network messages used for device discovery on local networks. When your browser looks for Chromecast/Smart TV devices on your network, it sends out special messages called “SSDP packets.”
Brave anonymizes the User Agent when looking for devices on your network, preventing others from knowing you’re using Brave. In addition, it is also proxied through Brave servers, removing some identifiable information like IP addresses. More on this here: https://github.com/brave/brave-browser/issues/18017
These privacy improvements maintain compatibility with the casting feature while reducing your digital fingerprint.
in the upper-right corner of the browser. There was no prompt, no warning, and no visible notification that Brave had connected to a device on the network.
