Brave’s value add is the zero knowledge proof. Meaning the browser sees absolutely everything you do (including website visits, mouse behavior, passwords, you name it) but that information never has to leave the client browser to serve you the most relevant ad. If it was ever discovered that this information was transmitted over the Internet to Brave, the entire ecosystem and value add would be called into question.

Someone would have to have remote access to your computer for them to exploit this but at that point it wouldn’t matter what browser you were using.

Yes, it is possible, if the dev team was compromised. In its current state, no. You can verify it yourself by using a web debugging tool like Fiddler.

In its current form no. But it could be added to the code in theory but the code is all public on GitHub