# Brave News feeds can open arbitrary chrome: URLs

Brave News RSS feed items with chrome: URLs opened privileged chrome:// pages, letting a feed bypass SOP and reach settings reset.

- Payout: hidden
- Severity: high
- Program: Brave Software
- Found by: nishimunea
- Disclosed: 2023-06-22
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1819668
- Library page: https://bugbountylibrary.com/r/h1%3A1819668
- Tags: area:os domain:browser impact:integrity impact:privesc kind:bounty platform:hackerone sev:high technique:recon vuln:open-redirect vuln:privilege-escalation

**Target:** Brave News RSS feed rendering in new tab
**Root cause:** Brave News did not validate/sanitize the scheme of feed item URLs before navigating, so attacker-supplied chrome: URLs were opened as privileged pages.
**Steps:**
1. Open new tab, click customize
2. Add `https://csrf.jp/brave/rss_chrome.php` as a Brave News RSS feed
3. Reload the tab; feed titled "Access chrome: URLs" appears
4. Click the feed item; `chrome://settings/resetProfileSettings?origin=userclick` opens in the tab
**How found:** Researcher suspected feed-supplied links were navigated without scheme restriction and tested a chrome://settings URL as a feed item.
**Exploitation:** Attacker hosts an RSS feed whose item link is a chrome: URL; victim adds it as a Brave News source and clicks the item, navigating to a privileged chrome:// page (e.g. profile reset).
**Insight:** Feed/aggregator content rendered in a privileged browser UI (new tab, news panels) is a path to chrome:// navigation; test whether item links are scheme-filtered rather than only HTML-sanitized.