# Brave Browser unexpectedly allows to send arbitrary IPC messages

Brave's internal JS called Function.prototype.call with IPC args, so page JS could hijack alert() to send arbitrary IPC messages, enabling UXSS and settings changes.

- Payout: hidden
- Severity: critical
- Program: Brave Software
- Found by: masatokinugawa
- Disclosed: 2018-09-18
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/187542
- Library page: https://bugbountylibrary.com/r/h1%3A187542
- Tags: area:os domain:browser impact:ato impact:integrity kind:bounty platform:hackerone sev:critical tech:electron technique:source-review vuln:prototype-pollution

**Target:** Brave browser internal JS / IPC message dispatch
**Root cause:** Brave's internal code invokes Function.prototype.call with IPC message arguments, and page JS can overwrite Function.prototype.call to intercept and rewrite those arguments before dispatch.
**Steps:**
1. Overwrite `Function.prototype.call` to inspect the first argument and, when it equals `window-alert`, replace the IPC message name and payload with attacker-chosen values.
2. Call `alert()` from page JS so Brave's internal alert handler invokes the hijacked `Function.prototype.call`.
3. The rewritten arguments are dispatched as arbitrary IPC messages (e.g. `dispatch-action` with `window-new-frame`, `window-set-url`, `window-set-navbar-input`, `app-change-setting`).
**How found:** Observed that Brave's internal alert() implementation routes IPC messages through Function.prototype.call, which is writable from page JS, making the argument-passing path attacker-controllable.
**Exploitation:** Attacker page overwrites Function.prototype.call, then calls alert(); the internal handler passes IPC args through the hijacked call, letting the attacker emit dispatch-action messages to open frames, set URLs to javascript: payloads (UXSS), spoof the address bar, or change browser settings like the homepage.
**Escalation:** Chained arbitrary IPC into UXSS via window-set-url with javascript: payloads, plus address bar spoofing and persistent settings modification.
**Insight:** When auditing Electron/Chromium-based browsers, check whether privileged internal code passes IPC message names/payloads through prototype methods (call/apply) reachable from page JS; overwriting those prototypes lets page script rewrite privileged messages.