# chrome://brave can still be navigated to, leading to RCE

Brave allowed navigating to chrome://brave via a bookmarked URL opened with middle-click/CTRL, chaining to a known RCE in that privileged page.

- Payout: hidden
- Severity: high
- Program: Brave Software
- Found by: qab
- Disclosed: 2018-10-23
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/415178
- Library page: https://bugbountylibrary.com/r/h1%3A415178
- Tags: area:os domain:browser impact:rce kind:bounty platform:hackerone sev:high tech:chromium technique:chained vuln:rce

**Target:** Brave browser bookmark bar / chrome://brave privileged page
**Root cause:** The bookmark navigation path did not block privileged chrome://brave URLs, so a bookmarked crafted URL could be opened with middle-click or CTRL+click, bypassing the normal navigation restriction.
**Steps:**
1. Host the PoC HTML page; it instructs saving the file locally and opening it from disk.
2. Open the saved PoC from local disk and click to open a popup.
3. Drag the anchor tag into the main window bookmark bar (or right-click and bookmark).
4. Hold CTRL and click the new bookmark, or right-click and choose 'open in new tab'.
5. The bookmark navigates to `chrome://brave`, reaching the privileged page tied to the RCE.
**How found:** Observed that chrome://brave could be reached via middle-click/CTRL+click only when coming from a bookmark, then used a drag-and-drop trick to get the crafted URL bookmarked.
**Exploitation:** Attacker tricks a user into bookmarking a crafted chrome://brave URL via drag-and-drop, then opening it with CTRL+click or middle-click, landing on the privileged page that leads to RCE (per report 395737).
**Escalation:** Chains with local-file detection bug 415167 to guess OS username/folder path and potentially drop HTML locally, removing the need to open the PoC from disk.
**Insight:** Privileged scheme navigation restrictions often only cover the address bar; test alternate entry points like bookmarks, middle-click, and CTRL+click, and use drag-and-drop to plant attacker-controlled bookmarks.