#chrome browser

u/Materidan on r/ios came upon a interesting discovery (https://www.reddit.com/r/ios/comments/14fdadr/brave_browser_may_be_compromised/)

To quote the post

> Brave Browser may be compromised.

> Really not sure where to post this, especially during the current API chaos in most subs.

> At any rate, I run a small informational website and had a message from someone complaining that whenever they tried to post using Brave on their iPhone or iPad, my adult filter would be triggered.

> So I downloaded Brave from the App Store onto my iPhone, tried it out and... same thing. Digging deeper, it turns out that if you have an input box using an HTML WYSIWYG editor such as CKEditor, a 36kb block of HTML set as invisible is being added to the bottom of anything submitted. This does not happen on plain text inputs.

> The block is full of links to adult sites, scam sites, referral links, trackers and so forth. This is the block I saw being added:

> https://controlc.com/353fb266

> To state the obvious, this is not happening on any other browser I own mobile or desktop, and the user was able to post fine using Safari. So the issue seems to have something to do with Brave. Take it for what it is.

> EDIT: I think I've found a way for anyone to confirm this. In Brave Browser (for iOS), go to:

> https://surveyjs.io/form-library/examples/custom-widget-ckeditor/angular

> Put something in the form, then hit COMPLETE. It will show you at the bottom what was submitted. There's even a button to copy it to clipboard, since on my iPhone I can't see much. But I end up with that huge block of HTML.

u/Asleep-Dingo-19 recorded the process described in the edits (in a comment) and uploaded it to imgur (https://imgur.com/gallery/o16w9CA).

I would also like to note that Brave already has a history of manipulating browser functions for their own benefit. For example when they made specific URLs redirect to the developer’s affiliate links in 2020.

What does this mean for you?

It means that the developers of Brave, have 2 times now manipulated the browser’s functionality in a attempt to profit themselves.

This is not the first time they have done something like this, and most likely won’t be the last time.

If the devs have done this two times, the next time may be even worse, and more privacy reducing then the prior attempts. Even spyware chrome doesn’t do this kind of thing. To give you a idea of how bad this is, if the devs chose to, they could theoretically log your passwords right as you enter them. Though I do not think that they would do something extremely illegal like this, they will definitely find in the future even more ways of profiting themselves (not even the company, just themselves) at your own loss.