A referral code substitution has been discovered in the Brave browser when opening certain websites.

In the Brave web browser identified referential links are inserted when attempting to open certain websites by entering their domain in the address bar (the links on open pages remain unchanged). For example, when entering "binance.com" in the address bar, the autocomplete function automatically adds the referral link "binance.com/en?ref=35089877" to the domain. Similar behavior has been observed for the domains coinbase.com, binance.us, ledger.com, and trezor.io. Such actions existed are perceived by many as inappropriate manipulation that undermines user trust, or as an attempt to secretly profit from unscrupulous participants in the project.

Project Manager explained, that the emergence of such functionality in the input autocomplete mechanism was caused by an error. Brave is indeed linked by a partnership program with Binance and some other cryptocurrency exchanges, but the referral code is used in a widget displayed in a dismissible advertising block on the new tab page. Autocomplete should not have added the referral code to the entered address, and this issue will be fixed.

The problem is caused by an oversight in the code transmitting the partner identifier when translating requests from the address bar to search engines. Entering keywords in the address bar results in sending a request to the search engine with the identifier being transmitted — all browsers participating in fee-generating referral programs transmit such identifiers for traffic. Due to the error, directly entering the domain of the recommended partner service also resulted in attaching the partner identifier in the address bar.

Let us remind you that the web browser Brave is developed under the guidance of Brendan Eich, the creator of JavaScript and former head of Mozilla. The browser is built on the Chromium engine, focuses on protecting user privacy, includes an integrated ad-blocking engine, can operate through Tor, and provides built-in support for HTTPS Everywhere, IPFS, and WebTorrent, offers an alternative to banners for funding publishers based on subscriptions. The project code is distributed is licensed under the MPLv2 license.

Addition: The fix came down to to disable by default the setting that controls Brave's recommendation substitution during autocomplete in the address bar (previously this setting was enabled by default). The list of replacements, which includes referral links, has been left unchanged.

Source: opennet.ru