Denial of service(POP UP Recursion) on Brave browser

How it was found

Summary:

Basically I have found a denial of service attack on brave browser in Linux platform.In this bug when we open the html file or visiting (www.tiks.host-ed.me) then click on pop up dos.html ,(which contains a recurring pop up code),the Pop up freezes the entire browser window except for minimize button and on maximizing it hangs, we can't close any tabs neither using (Ctrl+w) to close current tab that is causing recursion. This is a known issue and in past has been already addressed in browsers such as Google Chrome, however Brave Browser is still affected by the issue.And in safari browser Pop up's come after some time delays that allows user to stop the running process by clicking on (X) in URL.

Attack Scenario :-

This can be exploited by an attacker just by sending this html file or visiting (www.tiks.host-ed.me) to victim through email or any other source and when victim will open the html file in his/her Brave browser their window will freeze and they would need to kill the process in Linux(kill -9 pid) or (End Task) in windows. So to avoid such misuse of the issue some patches must be made.

The vulnerability occurred due to mishandling of location.reload function, as it keeps reloading the >document, however the issue more likely is present inside of not limiting the pop ups or simply offering no >way to ignore further prompts.

Products affected:

Brave browser(0.11.6) on Linux platform

Steps To Reproduce:

1.) Got o www.tiks.host-ed.me then click on pop up dos.html file or You can open the html code i have attached below on brave browser. 2.) You will see pop up like :-

{F131446}

And while in Google chrome this effect is limited by offering a checkbox to prevent the current document from creating additional dialogs. Like as shown below :-

{F131451}

Supporting Material/References:

I have attached POC images and html code that you will require in resolving the above issue.

Thanks sahiltikoo