# RCE: DnDing shortcut files to chrome://brave allows loading HTML files in Muon's context

Dragging a crafted .webloc shortcut into Brave navigates to chrome://brave, loading attacker HTML with ipcRenderer/ipcMain access, enabling arbitrary IPC and RCE.

- Payout: hidden
- Severity: high
- Program: Brave Software
- Found by: metnew
- Disclosed: 2018-10-22
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/415258
- Library page: https://bugbountylibrary.com/r/h1%3A415258
- Tags: area:os domain:browser impact:data-leak impact:rce kind:bounty platform:hackerone sev:high tech:electron technique:chained technique:incomplete-fix vuln:access-control vuln:info-disclosure vuln:rce

**Target:** Muon-based Brave browser (chrome://brave origin, Electron IPC)
**Root cause:** Chromium-level DnD of shortcut files (.webloc/.desktop) navigates to the URL they point to, allowing navigation to the privileged chrome://brave origin where HTML gains access to ipcRenderer/ipcMain and chrome.remote.getBuiltin.
**Steps:**
1. Create `etc-passwd.webloc` pointing to `chrome://brave/etc/passwd`
2. Open any page in Brave and drag-drop the .webloc file onto the tab
3. Brave navigates to `chrome://brave/etc/passwd`, rendering local file in privileged origin
4. Load attacker HTML in that origin using `<link rel="import" href="chrome://brave/etc/passwd">` to read local files
5. From that context access `chrome.remote.getBuiltin('ipcMain')` and `chrome.ipcRenderer` to send arbitrary IPC commands
6. For RCE: use IPC to download a `.terminal` file, then `chrome.remote.shell.openExternal` it to execute shell commands
**How found:** Prior report #395737 showed Brave supports chrome://brave/<local_file> URLs; after the patch blocked navigation and removed chrome.remote.require, researcher reasoned that DnD of shortcut files is handled at Chromium level and navigates to the file's target URL, bypassing the navigation block to reach chrome://brave.
**Exploitation:** Attacker with MITM (e.g. hosts entry `127.0.0.1 maps.googleapis.com` plus local MITM server) or reflected XSS on file:// origin serves a crafted .webloc; victim drags it into Brave, loading attacker HTML in chrome://brave origin. That HTML uses ipcRenderer/ipcMain to issue arbitrary IPC, download a .terminal file, and openExternal it, executing shell commands (PoC launches Calculator.app and reads /etc/passwd).
**Escalation:** From local file read to privileged origin to arbitrary IPC to shell command execution via .terminal + openExternal; also persistence via protocol module registration.
**Insight:** When a vendor blocks direct navigation to a privileged scheme, look for alternate navigation primitives (drag-and-drop of OS shortcut files, redirects, window.open) that reach the same origin; privileged origins often expose Electron IPC that turns file read into RCE.