# UXss on brave browser via scan QR Code

Brave Android QR scanner accepted a javascript: URI, executing script in the context of the currently open page (UXSS) and enabling cookie theft on any site.

- Payout: hidden
- Severity: high
- Program: Brave Software
- Found by: mrzheev
- Disclosed: 2023-04-11
- CVE: CVE-2022-23258
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1884042
- Library page: https://bugbountylibrary.com/r/h1%3A1884042
- Tags: area:mobile domain:browser domain:mobile impact:ato impact:data-leak kind:bounty platform:hackerone sev:high tech:android technique:regression vuln:misconfiguration vuln:xss

**Target:** Android Brave browser QR code scanner / URL bar
**Root cause:** The QR scanner passed scanned content directly to the URL loader without validating the scheme, so a javascript: URI was executed in the current page's origin instead of being treated as a search/URL.
**Steps:**
1. Open Brave on Android and navigate to www.google.com
2. Tap the URL bar and clear the URL via the cross icon
3. A 'Scan QR Code' button appears; tap it
4. Scan a QR code encoding `javascript:alert(document.domain);`
5. Script executes in the context of the open page (google.com)
**How found:** Researcher had previously found the same UXSS pattern in Microsoft Edge (CVE-2022-23258) and Oppo browser, then tested the QR-scan-to-URL path in Brave for the same javascript: scheme handling flaw.
**Exploitation:** Attacker supplies a malicious QR code; victim scans it via the URL-bar QR scanner while on a target site, and the javascript: URI runs in that site's origin, allowing cookie/session theft.
**Escalation:** Works against any open domain, so a single QR code can target arbitrary sites the victim is logged into.
**Insight:** QR/barcode scanners that feed results into the URL loader are a classic javascript:/data: scheme injection sink; test them on any mobile browser by clearing the URL bar to reveal the scanner and scanning a javascript: URI.