# Security token and handler name leak from window.braveBlockRequests

Brave iOS sets window.braveBlockRequests after page scripts run, so a page can pre-define it non-writable and steal the secret JS handler name and security token.

- Payout: hidden
- Severity: high
- Program: Brave Software
- Found by: nishimunea
- Disclosed: 2023-06-22
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1668723
- Library page: https://bugbountylibrary.com/r/h1%3A1668723
- Tags: area:mobile domain:browser domain:mobile impact:internal-access kind:bounty platform:hackerone sev:high tech:ios technique:source-review vuln:info-disclosure vuln:secrets-leak

**Target:** iOS WebView JS-to-native bridge (window.braveBlockRequests)
**Root cause:** The privileged bridge property is assigned after page scripts execute, allowing a page to pre-define it as non-configurable/non-writable and intercept the assignment carrying the secret handler name and token.
**Steps:**
1. Load a malicious page in Brave iOS 1.41.1.
2. Run `Object.defineProperty(window, "braveBlockRequests", {enumerable:false, configurable:false, writable:false, value:function(args){window.args=args}})` before the injected script runs.
3. Trigger request blocking so the legitimate script attempts to set braveBlockRequests.
4. Read `window.args` to obtain the secret handler name and security token.
**How found:** Noticed braveBlockRequests is set after page script execution, hypothesizing a page could pre-define it immutably to intercept the secret assignment.
**Exploitation:** Attacker page pre-locks the property, captures the secret handler name and token when Brave's script assigns it, then can invoke privileged native bridges directly.
**Escalation:** Impact scales with which native bridge is abused; more features increase risk.
**Insight:** When a privileged bridge injects secrets into a page global after page scripts run, pre-locking that property with defineProperty lets you capture the secret; check ordering of injected-script assignments vs page execution.