# Local files reading from the "file://" origin through `brave://`

HTML import from file:// origin could load brave:///etc/passwd, letting a local page read arbitrary local files despite a prior fix.

- Payout: hidden
- Severity: high
- Program: Brave Software
- Found by: metnew
- Disclosed: 2018-09-29
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/390362
- Library page: https://bugbountylibrary.com/r/h1%3A390362
- Tags: area:os domain:browser impact:data-leak kind:bounty platform:hackerone sev:high tech:chromium technique:incomplete-fix technique:source-review vuln:access-control vuln:info-disclosure

**Target:** Brave browser (Muon) internal brave:// scheme / HTML imports
**Root cause:** The fix for #390013 only blocked cross-origin access from web origins; file:// and brave:// are both treated as local origins, so a file:// page can still import brave:// resources and read their contents.
**Steps:**
1. Open a local HTML file (file:// origin) containing a `<link rel="import" href="brave:///etc/passwd" as="document" onload="show()">`.
2. In the onload handler, access `link.import.querySelector('body')` to get the imported document.
3. Read `file.innerHTML` — it contains the contents of /etc/passwd.
**How found:** Noticed the previous fix (#390013) only addressed web origins and reasoned that file:// and brave:// are both local origins, so cross-access between them likely remained; tested with an HTML import of brave:///etc/passwd.
**Exploitation:** Attacker delivers a local HTML file (or any file:// context) to the victim; when opened, the HTML import pulls brave:///etc/passwd and the script alerts its contents, exfiltrating local files readable by the browser process.
**Insight:** When a fix scopes a check to 'web vs local', test the other local scheme (file://, chrome://, brave://) as the attacker origin — internal schemes often share a trust tier and bypass the web-only guard.