# Navigation to restricted origins via "Open in new tab"

Brave allowed web pages to navigate to file:/// URLs via 'Open in new tab', letting attackers execute downloaded HTML on the local filesystem after learning the OS username via ssh://.

- Payout: hidden
- Severity: medium
- Program: Brave Software
- Found by: metnew
- Disclosed: 2018-10-09
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/369218
- Library page: https://bugbountylibrary.com/r/h1%3A369218
- Tags: area:os domain:browser impact:integrity kind:bounty platform:hackerone sev:medium tech:chromium technique:chained vuln:access-control vuln:info-disclosure

**Target:** Brave browser (browser-laptop, Muon) context menu navigation
**Root cause:** The 'Open link in a new tab' context-menu action did not restrict navigation to file:/// origins from web content, so a page could direct the browser to a local file path.
**Steps:**
1. Page requests navigation to `ssh://` and user agrees; attacker's host receives the connection and learns the OS username.
2. Page triggers a download of `file-load.html` (filename controlled via the `download` attribute).
3. User right-clicks a link pointing to `file:///Users/${USERNAME_FROM_SSH}/Download/file-load.html` and chooses 'Open in new tab'.
4. Navigation occurs and the downloaded HTML executes on the local file:/// origin.
**How found:** Noticed the context-menu 'Open in new tab' allowed file:/// navigation from web pages, then combined it with the previously reported ssh:// username leak and attacker-controlled download filenames to predict the local path.
**Exploitation:** Attacker learns the victim's OS username via an ssh:// navigation to their server, predicts the download path, then gets the victim to open a file:/// link to the downloaded HTML in a new tab, executing attacker HTML locally.
**Escalation:** Chains ssh:// username leak with attacker-controlled download filename to predict the local path; notes potential SOP bypass on file:/// for a full chain.
**Insight:** Context-menu navigation actions are a separate code path from normal link clicks and often skip origin restrictions; test 'open in new tab'/'open in window' with file:///, ssh:// and other privileged schemes, and combine with download-attribute filename control to predict local paths.