# `chrome://brave` available for navigation in Release build [-> RCE] + navigation to `chrome://*` using tab_helper ["Open in new tab"]

Brave's incomplete fix still allowed navigation to chrome://brave from a local file, exposing private Muon APIs and enabling RCE via child_process.exec.

- Payout: hidden
- Severity: high
- Program: Brave Software
- Found by: metnew
- Disclosed: 2018-09-25
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/395737
- Library page: https://bugbountylibrary.com/r/h1%3A395737
- Tags: area:os domain:browser impact:rce kind:bounty platform:hackerone sev:high tech:chromium technique:chained technique:incomplete-fix vuln:access-control vuln:rce

**Target:** Brave browser (Muon) chrome://brave origin and tab_helper 'Open in new tab'
**Root cause:** The prior fix for navigating to privileged origins only blocked about: and file: URLs, leaving chrome://brave reachable; pages loaded there get private Muon APIs (chrome.ipcRenderer/remote/webFrame/webViewRequest) and Brave is unsandboxed.
**Steps:**
1. Craft `exploit.html` that navigates to `chrome://brave` + a known local file path (attacker learns path via `window.location.pathname` after loading from `file://`).
2. Victim downloads `exploit.html` and uses tab_helper "Open in new tab" on the link.
3. New tab loads in chrome://brave context with private Muon APIs and a working `<webview>` tag.
4. Execute code via `chrome.remote.require('child_process').exec` to launch `Calculator.app`.
**How found:** Researcher recalled that report #369218 mentioned chrome:// navigation was possible; reviewing the fix PR #14973 showed it only handled about: and file: URLs, so chrome://brave remained reachable.
**Exploitation:** Attacker delivers an HTML file; victim opens it via 'Open in new tab', landing in the privileged chrome://brave origin where Muon APIs allow spawning processes (e.g. Calculator.app on macOS), achieving code execution on the device.
**Insight:** When a vendor patches a navigation/origin allowlist, check whether the fix enumerates only the schemes from the original PoC; privileged custom schemes (chrome://, app://) are often left out and grant internal APIs.