JavaScript URL Issues in the latest version of Brave Browser

How it was found

Summary:

• The URL javascript: can redirect users to any site, instead of executing JavaScript.

Additional Notes

• Found as partners by @kicker (http://hackerone.com/kicker) and myself (@smelt).

Products affected:

• The current version of Brave Browser on Windows.
• The current mobile version of Brave Browser.

Steps To Reproduce:

• Open Brave Browser

• Go to javascript:javascript: or javascript:javascript:hackerone.com in the Brave Browser.

• If using the javascript:javascript: link, the browser should redirect to your search engine's homepage.

• If using the javascript:javascript:hackerone.com link, the browser should redirect to HackerOne. (HackerOne was just an option, you can redirect to any URL.)

• This bug is different than the redirection bug previously disclosed, allowing addresses after @ to redirect to that site. The site can be redirected using simply the javascript: URL in this bug.

Supporting Material/References:

• See attached video files.

Thanks for reviewing this report, and let me cross my fingers, that it's not a duplicate! :)