# chrome://brave navigation from web

Brave browser allowed web pages to navigate to privileged chrome://brave pages via popups opened with the noopener attribute, violating SOP and risking RCE.

- Payout: hidden
- Severity: critical
- Program: Brave Software
- Found by: qab
- Disclosed: 2018-10-23
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/415967
- Library page: https://bugbountylibrary.com/r/h1%3A415967
- Tags: area:os domain:browser impact:privesc impact:rce kind:bounty platform:hackerone sev:critical tech:chromium vuln:access-control vuln:rce

**Target:** Brave browser privileged chrome:// page navigation
**Root cause:** Popup windows opened with the noopener attribute bypass the check that normally blocks web content from navigating to privileged chrome:// URLs, allowing a web page to load chrome://brave.
**Steps:**
1. Host the attached PoC page on a web server.
2. Open the page in Brave 0.24.0.
3. Click the button, which opens a popup with the noopener attribute targeting chrome://brave.
4. The privileged chrome://brave page loads from web origin.
**How found:** Reporter observed that popups opened with the noopener attribute were not subject to the same-origin/privileged-navigation restriction, then tested navigating to chrome://brave.
**Exploitation:** A single user click on a malicious page opens a noopener popup that navigates to chrome://brave, loading a privileged page from a web origin; the report notes this could lead to RCE.
**Escalation:** Loading chrome://brave (a privileged page) from web origin could be chained toward RCE, per the reporter.
**Insight:** Popup windows with noopener may skip navigation restrictions applied to normal frames/windows; test privileged scheme navigation (chrome://, about:) through noopener popups rather than direct top-level navigation.