# XSS on Brave Today through custom RSS feed

Brave Today on iOS accepted javascript: URLs in custom RSS feed links, executing script on privileged localhost origin when tapped.

- Payout: hidden
- Severity: medium
- Program: Brave Software
- Found by: nishimunea
- Disclosed: 2023-06-22
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1184379
- Library page: https://bugbountylibrary.com/r/h1%3A1184379
- Tags: area:mobile domain:mobile domain:web impact:privesc kind:bounty platform:hackerone sev:medium tech:ios technique:source-review vuln:xss

**Target:** Brave Today RSS feed reader (iOS app)
**Root cause:** The custom RSS feed feature did not restrict the URL scheme of entry links, allowing javascript: URIs to be rendered as tappable article links.
**Steps:**
1. Host an RSS feed with `<link rel="alternate" type="text/html" href="javascript:alert(document.domain)" />` in an entry
2. In Brave iOS Settings > Brave Today > Add Source, add the feed URL and enable it
3. Open a new tab, enable Brave Today, tap the 'XSS' entry
4. Script executes on http://localhost:65XX
**How found:** Noticed the new custom RSS feed feature and that article link URL schemes were unrestricted, hypothesizing javascript: would execute on tap.
**Exploitation:** Attacker publishes a malicious RSS feed; victim adds it as a Brave Today source and taps the crafted entry, executing JS in the privileged localhost origin hosting internal features.
**Insight:** When a feature renders user-supplied links inside a privileged origin (localhost/internal pages), test non-http schemes like javascript: and data: as href values, not just http(s).