# application/x-brave-tab should not be readable.

Brave's application/x-brave-tab drag payload is readable by attacker pages, leaking dragged tab history including a victim's Facebook profile URL.

- Payout: hidden
- Severity: high
- Program: Brave Software
- Found by: qab
- Disclosed: 2017-11-07
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/258578
- Library page: https://bugbountylibrary.com/r/h1%3A258578
- Tags: area:os domain:browser impact:data-leak kind:bounty platform:hackerone sev:high tech:chromium technique:recon vuln:info-disclosure

**Target:** Browser tab drag-and-drop data (application/x-brave-tab)
**Root cause:** The custom drag MIME type application/x-brave-tab containing the full tab object (including history array) is exposed to attacker-controlled drop targets instead of being restricted to browser-internal handling.
**Steps:**
1. Open attacker PoC page and click the button; a popup loads `https://www.facebook.com/me` which redirects to `https://www.facebook.com/{name}`, then redirects to a dummy page to seed history.
2. Drag the newly opened tab and drop it onto the large 'O' element on the attacker page.
3. Attacker page reads the dropped `application/x-brave-tab` data, obtaining the JSON tab object with the `history` array containing the victim's Facebook profile URL.
**How found:** Researcher noticed the custom x-brave-tab drag MIME type carried a full serialized tab object and tested whether an attacker page could receive it via a drop target.
**Exploitation:** Attacker lures victim to a page, opens a popup to facebook.com/me (redirects to the named profile), then tricks the victim into dragging that tab onto an attacker-controlled drop zone; the page reads the drag data and extracts the profile URL from the history array.
**Insight:** Custom browser-internal drag MIME types (application/x-*-tab) may be delivered to arbitrary web drop targets; test dropping tabs onto attacker pages to see if internal tab state/history is exposed.