Well... There's a more serious first start browser comparison by netmeister.org [0] which shows that 4 downloads are made. I downloaded and extracted the files

Well... There's a more serious first start browser comparison by netmeister.org [0] which shows that 4 downloads are made. I downloaded and extracted the files. They look like helpers or partials for Brave internal extensions. All of them include manifest files with their names: - 1_0_14: "Brave HTTPS Everywhere Updater extension". Contains a 1MB ZIPped database of https domains. - 1_0_21: "Brave NTP sponsored images component". Contains three photos (to display in their new tab probably). - 1_0_22: "Brave Local Data Files Updater extension". Seems to contain whitelists and blacklists for extensions, autoplay, referers, trackers, etc. - 1_0_498: "Brave Ad Block Updater extension". Contains a 2.4 MB filter list for their adblocker implementation. Nothing seems to be harmful at all. This mechanism is used by almost all Chrome/Chromium based browsers to update their internal extensions and components. But, if the poster cares about backdoors... Well, every major browser out there has features that could be used to backdoor their users like Firefox Telemetry Experiments (which download xpi files) and Chrome Components. They also can change properties at will unless its disabled (via flags, about:config, recompiling, etc). Note: I'm a Vivaldi and Chromium user. I only use Brave with iOS which is kind of a different beast (since everything has to be implemented on top of iOS provided WebKit) since it somehow blocks ads better than stock Safari with AdGuard filters. For stuff like banking (on iOS) I use Safari. Note 2: Blink and WebKit have deviated quite dramatically so they are indeed different browser engines (like Gecko is) with different implementations, quirks and bugs. [0] https://www.netmeister.org/blog/browser-startup.html https://www.netmeister.org/blog/browser-startup.html