Brave Software: OS username disclosure

Summary: Using the webkitdirectory alongside minor user interaction, we are able to grab OS username of a victim. This is because the webkitdirectory object is not properly sanitized after a folder has been picked. In my case, the downloads folder was the default folder to select and so I ended u...

Brave Software: application/x-brave-tab should not be readable.

Summary: It is possible to read a dragged tab object if user is coerced into drag and dropping it into attacker controlled page. This is bad because tab history is mentioned within the object, thus information leaks are possible through a trick. Products affected: Brave: 0.18.14 rev:...

Brave Software: URL Spoof / Brave Shield Bypass

Summary: Improper URL parsing in Brave allows an attacker to spoof the hostname shield settings are applied to. POC: https://youtu.be/yz99TTrfuc Products affected: Brave browser-laptop 0.18.14 rev ad92d02 Steps To Reproduce: 1. Browse to http://brave.com 2. Click on the Shield icon and toggle the...

Brave Software: homograph-attack (unicode vuln)

Hi team Summary: Affacted product appears identicaly different websites domains attacker uses unicode to register domains that look identical to real domains ,These fake domains can be used to fool users into signing into a fake website, thereby handing over their login credentials to an...

Brave Software: [iOS] URL can be replaceState by blob URL in iOS Brave

Summary: URL can be replace by blob URL using function history.replaceState Products affected: iOS brave version 1.3.117.02.14.11 Steps To Reproduce: - Add a html named "blob.html" which link is "http://192.168.1.111/blob.html" - And its source is:...

Brave Software: Brave payments remembers history even after clearing all browser data.

NOTE! Thanks for submitting a report! Please fill all sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty. Summary: As a user you expect the browser to not persist data after clearing browser data...

Brave Software: No user confirmation when an auto-updated extension gets more permissions

Summary: In Chrome, when extensions are auto-updated, if the permissions change, the extension is preventatively disabled and the user has to confirm they wish to re-enable it with the additional permissions. While it appears Brave has a functioning Extension auto-updater e.g. for the PDF...

Brave Software: Command Execution because of extension handling

Summary: Hello, Using this bug an attacker can execute commands as the current user using brave & gain complete shell capabilities and all possibilities associated Details: The issue is in the way the application handles website TLDs. typically in windows, .com represents an application, much...

Brave Software: [DOS] denial of service using code snippet on brave browser

Summary: brave browser hangs due to no validation for a code snippet causing denial of service to users. Products affected: latest brave browser in linux Steps To Reproduce: code snippet:- 1 window.location+='?\u202a\uFEFF\u202b'; OR 2 window.location+='?'+window.location.toString.split'';" Note ...

Brave Software: Remote Stack Overflow Vulnerability (DoS)

Allows remote attackers to cause a denial of service application crash resulting in stack overflow via nested calls to the window.print javascript function. Remote Stack Overflow DoS PoC Remote Stack Overflow DoS PoC Execute! function crash window.print; crash; Poc : Please find attached file POC...

Brave Software: invalid homepage URL causes 'uncaught typeerror' or blank state

Summary: The issue is when you set the homepage as https://brave.com;https://google.com.vn and then change the setting to launch brave with homepage Products affected: Tested on windows7 x64 + BraveSetup-ia32 Steps To Reproduce: 1.go to Settings - General, inject to "My home page is":...

Brave Software: [ios] Address bar spoofing in Brave for iOS

Hey Summary: I've found an address bar spoofing vulnerability in the latest version of Brave for iOS. Products affected: Brave for iOS 1.2.16 Android maybe? PoC: html var spoof = function document.write"This is not Google"; document.location = "https://google.com:1234";...

Brave Software: DOS in browser using window.print() function

Open the attached html poc in browser print window will appear again and again causing dos...

Brave Software: [iOS] URI Obfuscation in iOS application

Summary: you must trick someone into viewing a website they did not want to view by tempting them with something they are familiar with. Products affected: Brave iOS application https://itunes.apple.com/in/app/brave-web-browser/id1052879175?mt=8 this application is vulnerable to the URI obfuscati...

Brave Software: Access to local file system using javascript

Hey, The browser can access the local files using iframes with a local html file. this is very normal and often used for local web development but javascript shouldn't be able to get the content of that iframe because this can be used to post the contents to the attackers server. something else I...

Brave Software: Address Bar Spoofing - Already resolved - Retroactive report

Summary: All details were provided in the original report. You can read it here I'm reporting it here because I asked bcrypt if I should do it and he told me this: F127893 As she said me, I'm reporting here and indicating it's for a retroactive reward. If any identity confirmation or link between...

Brave Software: URI Obfuscation

Summary: Typically, when obfuscating a URL, you must trick someone into viewing a website they did not want to view by tempting them with something they are familiar with. Products affected: Latest Version of Brave in Windows Steps To Reproduce: We can trick someone into viewing it like this:...

Brave Software: [website] Script injection in newsletter signup https://brave.com/brave_youth_program_signup.html

go to https://brave.com/braveyouthprogramsignup.html click become an ambasador insert malicious payloads in the fields YOU JUST WON 1m$ you will receive a mail like in the image attached. You can send phising emails and do other bad stuff. If you need more details i'm here...

Brave Software: Brave: Admin Panel Access

Steps to reproduce While browsing through the https://blog.brave.com/admin, it is getting redirected to a admin login panel https://brave.ghost.io/ghost/signin/. Consequence An attacker can easily enumerate this admin panel with the url such as https://blog.brave.com/admin and with brute force...

Brave Software: 2 Directory Listing on ledger.brave.com & vault-staging.brave.com

Hi Brave team, Have found 2 Directory listing on: - https://ledger.brave.com/swaggerui/ - https://vault-staging.brave.com/swaggerui/ Refer to screenshosts for clarification: F127337 F127336...