# Local files reading using `link[rel="import"]`

Brave served local HTML files with Access-Control-Allow-Origin: *, letting a malicious page import file:///etc/passwd via link[rel=import] and read it.

- Payout: hidden
- Severity: high
- Program: Brave Software
- Found by: metnew
- Disclosed: 2018-09-29
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/375329
- Library page: https://bugbountylibrary.com/r/h1%3A375329
- Tags: area:os domain:browser impact:data-leak kind:bounty platform:hackerone sev:high technique:chained vuln:cors vuln:info-disclosure vuln:misconfiguration

**Target:** Brave browser (browser-laptop) local file handling
**Root cause:** Brave returned Access-Control-Allow-Origin: * for local HTML files, so HTML imports of file:// URLs were permitted cross-origin, exposing local file contents to the importing page.
**Steps:**
1. Host a malicious HTML page containing `<link id="link" href="file:///etc/passwd" rel="import" as="document" onload="show()" />`.
2. In the onload handler, read `link.import.querySelector('body')` and exfiltrate `innerHTML`.
3. Victim opens the page in Brave; the local file contents are imported and read.
**How found:** Researcher noticed Brave returns Access-Control-Allow-Origin: * for local HTML files and hypothesized HTML imports could bypass the local-file same-origin restriction.
**Exploitation:** Attacker page imports a file:// URL as an HTML import; because Brave's ACAO:* on local files allows the cross-origin import, the page reads the imported document's body and can exfiltrate local file contents.
**Escalation:** Report notes this makes issue #369218 critical, implying chaining with another flaw.
**Insight:** When a browser sets permissive CORS headers on file:// responses, test legacy HTML import (link[rel=import]) and other subresource loads against file:// URLs to bypass local-file isolation.