Critical Security Issue: Browser Doesn't Log Out After Closing

Browser Support Desktop Support
, ,
1

I have encountered a critical security issue, but I am not sure whether it’s related to Brave Browser or Bitwarden.

I have set Brave Browser to always log me out of websites when I close the browser, so it does not remember my login credentials. However, I have noticed that sometimes, after restarting my computer, I can still access my email without entering my login details or even the two-factor authentication (2FA) code.

This is a serious security concern, as it means that my session is somehow being preserved despite the browser being set to clear all login data.

Has anyone else experienced this issue? Could this be a bug in Brave Browser, or is it related to Bitwarden? Any help would be greatly appreciated.

2

@Fearplay thanks for reporting. What Brave version are you on? Does it happen if you disable the Bitwarden extension?

3

Hello steeven, so I figured out the way how to reproduce it.

  1. I log in to GitHub.com.
  2. I minimize the Brave browser.
  3. I turn off the entire Windows computer.
  4. I turn on the entire Windows computer.
  5. I open the Brave browser.
  6. I open the GitHub.com page.
  7. I am logged in.
    It looks like, even though I have enabled the setting for Brave browser to delete cookies upon exiting the browser, when I shut down the computer, Brave does not behave as if I am leaving the application.
    My version of brave is 1.76.73
    image
    image863×817 48.6 KB

    image
    image904×820 51.1 KB
4

Can you clarify here? Are you minimizing the browser or completely closing it? Minimizing the browser does not provide a full closure of Brave.

5

I am just minimalizing it. But still turn off the whole computer should close the browser. I tried this in firefox and this didn’t work. So it seems like that by turning off whole computer you won’t close the brave browser but firefox yes. So I think this is a bug.

6

What do your Continue where I left off settings look like here: brave://settings/getStarted

7

It looks like this

image
image1183×943 32.8 KB

8

The Continue where I left off option is on by default when you install Brave. Do you know when you enabled Open the New Tab page instead?

9

I was installing Brave Browser few days ago. And I setup to delete cookies aftere closing the browser and also setting this “On startup” to be Open the New Tab page but still if I turn off computer then the cookies should be deleted as well right? Or they are deleted only when I have Continue where you left off? But I see that it is in the process to be fixed in the future. So nevermind then.