Brave Desktop - OS Command Injection

Vulnerabilities type : OS Command Injection (Patched)
Effected : Desktop applications

The issue is in the way the application handles website TLDs. typically in windows, .com represents an application, much similar like .exe - when Brave saves a website (Ctrl+S) - it uses the name of the website. For PoC purpose I used .bat TLDs because they are much easier to show a poc with instead of binary application garbage data. In Windows, Microsoft warns users when they execute applications that are downloaded, this can simply be bypassed by sending filenames with words like Update or Setup... yeah, I can't believe this works too.