Skip to content

Vendor

duckduckgo vulnerabilities

3 published CVES affecting duckduckgo, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
1
Medium
2
Low
0
Unscored
0
CISA KEV
0
Atom feed of duckduckgo alerts

Products

Latest duckduckgo CVEs

Newest publication first

  1. CVE-2025-48464 Exposure of Sensitive Information

    Published
    MediumCVSS 4.7 EPSS 0.14%

    Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim’s Sync account data such as account credentials and email protection information.

  2. CVE-2021-44683 The DuckDuckGo browser 7.64.4 on iOS allows Address Bar Spoofing due to mishandling of the JavaScript window.open function (used to open a secondary browser window). This could be exploited by trickin...

    Published
    HighCVSS 8.2 EPSS 0.97%

    The DuckDuckGo browser 7.64.4 on iOS allows Address Bar Spoofing due to mishandling of the JavaScript window.open function (used to open a secondary browser window). This could be exploited by tricking users into supplying sensitive information such as credentials, because the ad...

  3. CVE-2018-6849 In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP addre...

    Published
    MediumCVSS 4.3 EPSS 28.7% Framework module Public exploit

    In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.