# Cookie steal through content Uri

Brave Android's FileProvider used root-path '.', letting a malicious app trigger download of the internal Cookies database to public Downloads and steal all cookies.

- Payout: hidden
- Severity: critical
- Program: Brave Software
- Found by: kanytu
- Disclosed: 2021-04-22
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/876192
- Library page: https://bugbountylibrary.com/r/h1%3A876192
- Tags: area:mobile domain:mobile impact:ato impact:data-leak kind:bounty platform:hackerone sev:critical tech:android technique:source-review vuln:info-disclosure vuln:misconfiguration vuln:path-traversal

**Target:** Android content provider (ChromeFileProvider) in com.brave.browser
**Root cause:** FileProvider paths config declares `<root-path name="root" path="." />`, exposing the entire filesystem root; Brave resolves its own content:// URIs without permission grants and downloads application/octet-stream files to public Downloads.
**Steps:**
1. Install PoC app with STORAGE permission; ensure Brave has STORAGE permission and saved cookies.
2. PoC sends intent to Brave with URI `content://com.brave.browser.FileProvider/root/data/data/com.brave.browser/app_chrome/Default/Cookies`.
3. Brave resolves its own FileProvider URI (no grant needed) and downloads the file as application/octet-stream to `/sdcard/Download/`.
4. PoC watches Downloads directory, opens the Cookies SQLite DB, and prints all cookies.
**How found:** Researcher reviewed the FileProvider paths XML, noticed `root-path` with path `.` exposing the filesystem root, and reasoned Brave would self-resolve its own content URIs without permission grants, then download based on mime type.
**Exploitation:** Malicious app with STORAGE permission fires an intent at Brave pointing to the internal Cookies DB via the root-path FileProvider; Brave self-resolves and copies the file to public Downloads, where the attacker reads it and extracts session cookies for account takeover.
**Escalation:** root-path '.' allows targeting any internal file, not just cookies (passwords, traces, etc.).
**Insight:** When auditing Android apps, grep FileProvider path configs for `root-path` with `.` or overly broad paths; then check whether the app self-resolves its own content:// URIs (no grant needed) and auto-downloads octet-stream files to public storage.