CITT

    Scan results

    Brave Private Web Browser, VPN

    Android

    Browse 3X faster on Brave Browser. Get a lightning fast, safe and private web browser with AI, Adblock, and VPN. Loved by over 100 million users, Brave has AI assistant Brave Leo, Firewall + VPN, Brave Search, and night mode.

    CITT SCORE
    62
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Ad-blocking users comfortable with Google services

    Not For: Those trying to avoid Google's data ecosystem

    What It Means For You

    The device connects to Google's infrastructure through several built-in Google services, including location, sign-in, and vision APIs. Firebase components report installation and usage data back to Google. The VPN feature uses WireGuard, but overall data exposure to Google is significant despite the browser's privacy branding.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (19)

    Data Security

    2 total
    1 Critical
    1 High

    Network Security

    2 total
    1 Critical
    1 Medium

    Code Security

    8 total
    1 High
    4 Medium
    3 Low

    Privacy

    7 total
    1 Critical
    6 High

    Third-Party Services

    Firebase Cloud Messaging, Firebase Installations, Google DataTransport, Google Play Services Cast, Google Play Billing, Google Location Services, Google Sign-In API, Google Vision API, Google Safe Browsing, WireGuard VPN

    Security Strengths

    • ✓Multi-process architecture with 40 sandboxed renderers
    • ✓85% code obfuscation (6,200 classes)
    • ✓Backup disabled in manifest
    • ✓Process isolation with isolatedProcess=true
    • ✓Memory tagging enabled
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    privacy
    tracking
    google
    analytics
    credentials
    sensitive data
    location
    network security

    Package

    com.brave.browser

    Version

    1.85.120 (Chromium 143.1.85.120)

    Analysis Date

    Feb 6, 2026

    Classes Analyzed

    7,241

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 2 findings (1 critical, 1 high)

    Network Security - 2 findings (1 critical, 1 medium)

    Code Safety - 0 findings

    Privacy - 7 findings (1 critical, 6 high)

    Privacy Concerns

    What Data is Collected

    The app collects location data, sign-in information, and usage patterns through multiple Google services embedded in its core functionality. Firebase components gather device identifiers and report installation events. Google Play Billing monitors in-app purchase activity.

    Third-Party Data Sharing

    User data is shared with the following third-party services:

    • Firebase Cloud Messaging
    • Firebase Installations
    • Google DataTransport
    • Google Play Services Cast
    • Google Play Billing
    • Google Location Services
    • Google Sign-In API
    • Google Vision API
    • Google Safe Browsing
    • WireGuard VPN

    Understanding the Scores

    CategoryScore
    Security65/100
    Privacy60/100
    Data Security65/100
    Network Security70/100
    Code Safety85/100
    Data Collection65/100
    Data Sharing60/100
    User Control75/100

    Positive Security Features

    • The VPN feature is built on WireGuard, a modern protocol with a strong security design.
    • Google Safe Browsing integration helps shield browsing from known harmful sites.

    Areas for Improvement

    • Connections to Google services run throughout the app, sharing usage data with Google even during private browsing sessions. Reducing these integrations would bring the app closer to its stated privacy goals.
    • Network activity reaches multiple Google-operated servers in ways that are not always easy to disable, limiting how effectively users can keep their browsing patterns private.
    • Location, sign-in, and usage data flow across several Google services simultaneously, meaning a single company has a broad picture of user activity despite the app's privacy positioning.

    About This Analysis

    This scorecard is based on static analysis of the app as distributed on the scan date. Results reflect the app's code and configuration at that point in time and do not cover server-side behavior.

    App Details

    • App Name: Brave Private Web Browser, VPN
    • Package ID: com.brave.browser
    • Version: 1.85.120 (Chromium 143.1.85.120)
    • Scan Date: 2026-02-06

    Right of Reply

    Developer not yet contacted