# Sending arbitrary IPC messages via overriding Function.prototype.apply

Overriding Function.prototype.apply in page JS hijacks Brave's internal ipc_utils.js emit, letting attacker send arbitrary IPC messages to change settings and spoof UI.

- Payout: hidden
- Severity: critical
- Program: Brave Software
- Found by: masatokinugawa
- Disclosed: 2018-09-18
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/188086
- Library page: https://bugbountylibrary.com/r/h1%3A188086
- Tags: area:os domain:browser impact:integrity impact:privesc kind:bounty platform:hackerone sev:critical tech:electron technique:source-review vuln:privilege-escalation

**Target:** Brave browser renderer IPC bridge (ipc_utils.js / ipcRenderer)
**Root cause:** Brave's internal ipc_utils.js calls EventEmitter.prototype.emit.apply, which resolves to the page-controllable Function.prototype.apply; the page overrides apply to intercept the leaked ipcRenderer object and send arbitrary IPC messages.
**Steps:**
1. Load a page containing `Function.prototype.apply=function(ipc){ ipc.send("dispatch-action",'{"actionType":"app-change-setting","key":"general.homepage","value":"http://attacker.example.com/"}'); }`
2. Include a hidden `<embed src=".swf">` to trigger the internal emit path
3. Open `about:preferences` and observe homepage changed to attacker URL
**How found:** Noticed internal ipc_utils.js uses EventEmitter.prototype.emit.apply, a prototype method reachable/overridable from page JS, and that the first argument leaks the ipcRenderer object; hypothesized overriding apply would intercept it.
**Exploitation:** Attacker page overrides Function.prototype.apply; when Brave's ipc_utils.js emit runs, the overridden apply receives the ipcRenderer object as first argument, which the attacker uses to call ipc.send with arbitrary dispatch-action payloads, changing browser settings and enabling UXSS/address bar spoofing.
**Escalation:** Arbitrary IPC send enables UXSS and address bar spoofing beyond the demonstrated settings change.
**Insight:** When a privileged internal script calls a built-in prototype method like .apply/.call/.emit, page JS can override that prototype method to intercept privileged objects passed as arguments; look for internal code invoking prototype methods on objects that carry IPC or native bridges.