CVE-2020-15502

HIGH 7.5CVE-2020-15502 · Published 02/07/2020 · updated 17/06/2026

In short

CVE-2020-15502 is a HIGH (CVSS 7.5) vulnerability affecting duckduckgo (duckduckgo).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 74.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
duckduckgo duckduckgo	`≤ 5.58.0≤ 7.47.1.0`	No fix yet

Description

The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers in the duckduckgo.com domain, which might make visit data available temporarily at a Potentially Unwanted Endpoint. NOTE: the vendor has stated "the favicon service adheres to our strict privacy policy.

References

duckduckgo/Android · Patch
duckduckgo/Android · Third Party Advisory
duckduckgo/iOS · Third Party Advisory
news.ycombinator.com/item · Patch
news.ycombinator.com/item · Third Party Advisory

More vulnerabilities in duckduckgo

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free