Brave Software: `alert()` dialogs on `chrome-extension://` origin (internal pages)

Summary: Navigation to chrome-extension from the web is possible with 378805 ftp:// - chrome-extension://. A blank page is created during navigation to chrome-extension:// origin. Blank pages have "This page" title. It's possible to initiate alert with a social-engineering content and "This page"...

Brave Software: Navigation to `chrome-extension://` origin (internal pages) from the web

Summary http and https pages are disallowed from navigating to chrome-extension:// origin. However, ftp protocol isn't checked. Pages from ftp:/// and file:/// origin could navigate to chrome-extension:// origin. Steps to reproduce: 1. Start ftp server sample ftp server attached, npm i ftpd && no...

Brave Software: `settingcontent-ms` files lacks "mark of the web" => execute code by dbl click in Downloads toolbar

Summary: settingcontent-ms files allow launching any binary with any params. Brave doesn't mark settingcontent-ms files with "mark of the web", so the file could be executed by double click in "Downloads" toolbar. Launched settingcontent-ms file could lead to code execution with user-level...

Brave Software: Local files reading using `link[rel="import"]`

Summary: HTML file could import another file using . Brave returns Access-Control-Allow-Origin: response header for local HTML files. That leads to local files reading. This vulnerability makes 369218 critical. Products affected: Brave: 0.23.19 V8: 6.7.288.46 rev:...

Brave Software: Cross-origin page stays focused before/after downloading + uninformative modal window for download

Summary: 1. Open twitter.com using window.open 2. Wait some time to finish page rendering 3. Change location of the opened page to any downloading 4. Download modal appears above the twitter.com The problem is that a user doesn't see what page exactly initiates downloading and what resourceURL wi...

Brave Software: Navigation to protocol handler URL from the opened page displayed as a request from this page.

Summary: Navigation to protocol handler URL from the page opened using window.open is considered as a request from the opened page. Example: 1. The page opens google.com 2. The page changes opened window's location to ssh://evil.com 3. Request to open ssh://evil.com URL displayed at google.com...

Brave Software: Lack of quarantine meta-attribute for downloaded files leads to GateKeeper bypass

Summary: Executable files downloaded through Brave don't have quarantine attribute. That means it's possible to launch any executable bypassing codesigning + quarantine. However, later I found that Brave has already tracked similar report but only in the context of .pkg files. Additionally, Brave...

Brave Software: OPEN REDIRECTION at every 302 HTTP CODE

Summary i guess every 302 HTTP CODE on https://publishers.basicattentiontoken.org possible to OpenRedirection Steps To Reproduce: 1. I edited the request when i got redirected from this request url...

Brave Software: Navigation to restricted origins via "Open in new tab"

Summary: It's possible to open links pointing to file:/// origin from web pages using "Open link in a new tab" in context menu. https://hackerone.com/bugs?reportid=369185 shows unsafe ssh:// protocol handling, which leads to information leak using sshOS username and etc.. The vulnerability is...

Brave Software: DoS in Brave browser for iOS

Summary: Attacker could initiate DoS during page loading. Products affected: 1.6 18.05.17.13 Device iPhone 6s iOS 11.3.1 Steps To Reproduce: PoC: html let o = document.body.appendChilddocument.createElement'object'; // application/json or application/pdf are valid values too o.type = 'text/html' ...

Brave denial of service vulnerability

Brave is a Web browser product from Brave Software, Inc. in the United States. A security vulnerability exists in versions of Brave prior to 0.14.0 on Linux or other platforms, which stems from a failure to properly handle long URLs and can be exploited to cause a denial of service application ha...

Brave Software: There is vulnebility Click Here TO fix

NOTE! Thanks for submitting a report! Please fill all sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty. Summary: add summary of the vulnerability Products affected: operating system, Brave versi...

CVE-2017-1000461

Brave Software's Brave Browser, version 0.19.73 and earlier is vulnerable to an incorrect access control issue in the "JS fingerprinting blocking" component, resulting in a malicious website being able to access the fingerprinting-associated browser functionality that the browser intends to block...

Design/Logic Flaw

Brave Software's Brave Browser, version 0.19.73 and earlier is vulnerable to an incorrect access control issue in the "JS fingerprinting blocking" component, resulting in a malicious website being able to access the fingerprinting-associated browser functionality that the browser intends to block...

CVE-2017-1000461

Brave Browser (0.19.73 and earlier) is affected by CVE-2017-1000461 due to an incorrect access-control flaw in the JS fingerprinting blocking component. This vulnerability could allow a malicious website to access fingerprinting-related browser functionality that the browser intends to block. The...

Brave Software: Torrent Viewer extension web service available on all interfaces

Summary: When files are downloaded via the Torrent Viewer, a local web service is spun up that allows the user to download the files. This web service listens on all interfaces, allowing anyone in the network to view what files are being downloaded, and download them from the user. This mostly...

Brave Software: Download of (later executed) .NET installer over insecure channel

NOTE! Thanks for submitting a report! Please fill all sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty. Summary: Execution of file NDP-KB2901954-Web.exe fetched via...

Brave Software: Arbitrary local code execution via DLL hijacking from executable installer

NOTE! Thanks for submitting a report! Please fill all sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty. Summary: The executable installer BraveSetup-ia32.exe is vulnerable to DLL hijacking: it...

Brave Software: Homograph Attack Bypass [ Tested on Linux & Windows ]

Summary: at 175286 you has been patched, and i try it work, but i've another way to bypass it. when we add a site to our Homepage with @, it's not validate a url properly, make sure it's display the punycode. Products affected: Brave 0.18.36 Linux & Windows Steps To Reproduce: 1. In browser add...

Brave Software: Download attribute allows downloading local files

Summary: The attribute download in a a tag allows for download the href target to file and saving it locally. In mozilla and chrome, it is forbidden to download local file via file:// .., in Brave however this is not enforced and it is not clear to the user if they are downloading something remot...