# Universal XSS with Playlist feature

Brave iOS Playlist leaked security and message-handler tokens to web pages, letting a malicious iframe inject JS via nodeTag into PlaylistHelper and achieve UXSS on any domain.

- Payout: hidden
- Severity: high
- Program: Brave Software
- Found by: nishimunea
- Disclosed: 2023-06-22
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/1436558
- Library page: https://bugbountylibrary.com/r/h1%3A1436558
- Tags: area:mobile domain:browser domain:mobile impact:integrity kind:bounty platform:hackerone sev:high tech:ios technique:chained technique:source-review vuln:command-injection vuln:xss

**Target:** Brave iOS Playlist feature / UserScriptManager and PlaylistHelper
**Root cause:** Playlist.js and WindowRenderHelper.js embed secret securityToken and messageHandlerToken values into page-accessible JS prototypes, and PlaylistHelper.swift concatenates attacker-controlled nodeTag into a JS string executed on the mainframe.
**Steps:**
1. Load a malicious page in an iframe that reads the securityToken from HTMLVideoElement.prototype.setAttribute's embedded $<notifyNode> value.
2. Read the messageHandlerToken from WindowRenderHelper.js's embedded $<handler> value in W{securityToken}.postMessage.
3. Send a crafted message to playlistHelper with nodeTag containing `');alert(document.location);//`.
4. Trigger 'Add to Brave Playlist' then 'Open' in the settings menu.
5. Observe alert() executing on the top-level origin, confirming UXSS.
**How found:** Code review of Playlist.js and WindowRenderHelper.js revealed secret tokens embedded into page-readable JS objects; reading PlaylistHelper.swift showed nodeTag concatenated into executed JS, suggesting a breakout payload.
**Exploitation:** A cross-origin iframe on an attacker page extracts both hidden tokens from page-visible JS, then posts a message to PlaylistHelper with a nodeTag payload that breaks out of the concatenated JS string; when the user adds and opens the Playlist item, the injected code runs on the mainframe of the victim origin.
**Escalation:** Chaining token disclosure with string-concatenation injection escalates a single-page script injection into Universal XSS across arbitrary domains.
**Insight:** Native apps that inject secrets into page-visible JS prototypes (setAttribute, postMessage wrappers) leak them to any page; grep injected user scripts for token interpolation and trace where those tokens gate privileged native message handlers.