# Local files reading from the web using `brave://`

Brave's brave:// scheme allowed web pages to import and read local files like /etc/passwd via HTML imports, bypassing file:// restrictions.

- Payout: hidden
- Severity: critical
- Program: Brave Software
- Found by: metnew
- Disclosed: 2018-09-25
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/390013
- Library page: https://bugbountylibrary.com/r/h1%3A390013
- Tags: area:os domain:browser impact:data-leak kind:bounty platform:hackerone sev:critical tech:chromium technique:incomplete-fix technique:regression vuln:access-control vuln:info-disclosure

**Target:** Brave browser brave:// protocol handler / HTML imports
**Root cause:** The brave:// protocol handler introduced to replace AsarProtocolHandler did not restrict web-origin pages from importing local file paths, so HTML imports resolved brave:///etc/passwd and exposed file contents to script.
**Steps:**
1. Host an HTML page containing `<link id="link" href="brave:///etc/passwd" rel="import" as="document" onload="show()" />` and a script that reads `link.import.querySelector('body').innerHTML`
2. Open the page from the web in Brave 0.23.73
3. Page alerts the contents of /etc/passwd
**How found:** Researcher noted that the fix for issue #375329 replaced AsarProtocolHandler with brave://, then reused the same HTML-import PoC but swapped file:// for brave:// to test whether the new scheme enforced the same origin restrictions.
**Exploitation:** A malicious web page uses an HTML import pointing at brave:///etc/passwd; on load, the imported document's body is read via link.import and exfiltrated/alerted, giving the web origin read access to arbitrary local files.
**Insight:** When a vendor replaces a privileged protocol handler, re-run prior file:// import/read PoCs against the new scheme name — the replacement often lacks the origin checks the original had.