# Onion-Location header allows to open arbitrary URLs including chrome:

Brave's Onion-Location header handling opened arbitrary schemes like chrome:// and javascript:, letting a malicious page reach privileged URLs and restart the browser.

- Payout: hidden
- Severity: high
- Program: Brave Software
- Found by: nishimunea
- Disclosed: 2023-06-22
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1089995
- Library page: https://bugbountylibrary.com/r/h1%3A1089995
- Tags: area:os domain:browser impact:dos impact:integrity kind:bounty platform:hackerone sev:high technique:source-review vuln:dos vuln:open-redirect

**Target:** Browser Onion-Location header handler / 'Open in Tor' feature
**Root cause:** The 'Open in Tor' feature passed the Onion-Location header value to URL opening without validating the scheme, so non-onion schemes like chrome: and javascript: were accepted.
**Steps:**
1. Serve a page with response header `Onion-Location: chrome://restart/`
2. Click the 'Open in Tor' button in Brave's address bar
3. Observe `chrome://restart/` opens and Brave restarts
4. If 'Automatically redirect .onion sites' is enabled, the restart triggers automatically and loops endlessly
**How found:** Reviewed the PR introducing the 'Open in Tor' feature and noticed the Onion-Location header value was used to open URLs without scheme restriction, then tested with chrome://restart/.
**Exploitation:** Attacker hosts a page returning an Onion-Location header with a privileged scheme (chrome://restart/ or javascript:); when the victim clicks 'Open in Tor' (or auto-redirect is enabled), the browser navigates to the privileged URL, bypassing SOP.
**Escalation:** Enabling auto-redirect turns a single click into an automatic endless restart loop (DoS).
**Insight:** When a browser feature consumes a server-controlled header to trigger navigation, test non-http schemes (chrome:, javascript:, file:) — header-driven navigation often skips the scheme checks applied to user-typed URLs.