# [Android] HTML Injection in BatterySaveArticleRenderer WebView

Brave Android's BatterySaveArticleRenderer WebView concatenated page title/author into HTML unescaped, letting a malicious page inject HTML/JS into the article reader.

- Payout: hidden
- Severity: high
- Program: Brave Software
- Found by: bobrov
- Disclosed: 2018-10-22
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/176065
- Library page: https://bugbountylibrary.com/r/h1%3A176065
- Tags: area:web3 domain:mobile domain:web3 impact:integrity kind:bounty platform:hackerone sev:high tech:android technique:source-review vuln:xss

**Target:** Android Brave Browser article-mode WebView renderer
**Root cause:** BatterySaveArticleRenderer builds HTML by string-concatenating the page title and author name into <title>/<p>/<span> without escaping, so attacker-controlled metadata becomes markup.
**Steps:**
1. Host a page whose title contains `</title><h1><marquee><s>Injection<!--` (via `location="https://www.google.com/search?q=</title><h1><marquee><s>Injection<!--"`).
2. Open the page in Brave Android 1.9.56 and wait for full load.
3. Tap the ArticleModeButton to render the article view.
4. Injected markup executes/renders inside the WebView.
**How found:** Code review of the decompiled `aot` class showed title (s7) and authorName (s8) appended into HTML strings without encoding.
**Exploitation:** Attacker-controlled page title is injected into the article-mode WebView HTML; the injected markup renders in the privileged WebView context.
**Insight:** Reader/article-mode renderers that rebuild pages from scraped metadata (title, author, byline) are prime HTML-injection sinks; check every metadata field concatenated into the generated HTML template.