# URL spoofing using protocol handlers

Brave failed to reset the address bar to about:blank after opening an unknown protocol URL, letting a parent window write content while the bar showed a trusted-looking URL.

- Payout: hidden
- Severity: medium
- Program: Brave Software
- Found by: metnew
- Disclosed: 2018-10-04
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/373721
- Library page: https://bugbountylibrary.com/r/h1%3A373721
- Tags: area:os domain:browser impact:integrity kind:bounty platform:hackerone sev:medium technique:source-review vuln:open-redirect

**Target:** Browser address bar / protocol handler navigation
**Root cause:** Brave does not clear the address bar to about:blank when a parent window accesses a window opened with an unrecognized protocol handler URL, unlike other browsers.
**Steps:**
1. Open a page with `window.onclick` handler calling `x = window.open('http.://google.com')` (note trailing dot in scheme).
2. After ~1s, parent calls `x.document.write(...)` to inject attacker HTML/JS into the opened window.
3. Address bar still shows the protocol-handler URL while attacker content renders, spoofing the origin.
**How found:** Observed that browsers normally reset to about:blank when a parent accesses a protocol-handler window; tested Brave with a malformed scheme (`http.://`) and found the address bar was not cleared.
**Exploitation:** Attacker page opens a window to a malformed protocol URL, then writes arbitrary HTML/JS into it after a timeout; the address bar retains the spoofed URL, so injected content (e.g. fake Google login) appears to originate from that URL.
**Insight:** Malformed schemes with a trailing dot (e.g. `http.://`) bypass scheme recognition and leave the address bar showing attacker-chosen text; test cross-window document.write against such URLs to check for missing about:blank resets.