WS-2023-0186

In brave, Onion-Location header allows to open arbitrary URLs including chrome. This behavior can be exploited as a way to bypass SOP and gain access to privileged URLs...

Brave Software: Onion-Location header allows to open arbitrary URLs including chrome:

The "Open in Tor" feature in Brave Nightly for OSX allowed arbitrary URLs to be opened through the Onion-Location response header, including privileged URLs such as chrome://restart/. This could be exploited to bypass SOP restrictions and gain access to privileged URLs...