# Tor IP leak caused by the PDF Viewer extension in certain situations

Brave's built-in PDF viewer extension made unproxied AJAX requests in Tor windows before any HTTP page loaded, leaking the user's real IP.

- Payout: hidden
- Severity: medium
- Program: Brave Software
- Found by: world_languages
- Disclosed: 2023-08-02
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/604945
- Library page: https://bugbountylibrary.com/r/h1%3A604945
- Tags: area:os domain:browser impact:data-leak kind:bounty platform:hackerone sev:medium tech:chromium technique:source-review vuln:info-disclosure

**Target:** Brave browser Tor mode / built-in PDF viewer extension
**Root cause:** Tor proxy is only engaged after an HTTP/HTTPS page is loaded via the address bar in a Tor window; extension AJAX requests before that bypass the proxy.
**Steps:**
1. Close Brave fully (kill processes).
2. Reopen Brave and open a Tor window without visiting any site.
3. Navigate to `chrome-extension://oemmndcbldboiebfnladdacbdfmadadm/http://ip-pdf.glitch.me/`.
4. Observe the returned PDF contains the real IP, not the Tor exit IP.
5. Optionally load duckduckgo.com in the Tor window and refresh; request is now proxied.
**How found:** Researcher reasoned that built-in extensions run in Tor mode and that proxy activation depends on loading an HTTP page; tested the PDF viewer's AJAX fetch before any page load.
**Exploitation:** Attacker hosts a PDF URL and lures a Brave Tor user to open it via the PDF viewer extension URL; the server logs the victim's real IP.
**Insight:** Built-in/privileged extensions that run in privacy modes can issue network requests before the proxy is initialized; test extension-initiated fetches in fresh private/Tor sessions before any normal navigation.