Danyil Vasilenko Bolt Browser Address Bar Spooofing

An attacker hosts a malicious page that executes JavaScript which writes fake content (e.g., a Gmail login page) via `document.write()` and then calls `window.location.assign("https://www.Gmail.com:8080")` while repeatedly triggering the spoof via `setInterval()` [ref_id=1]. Because Bolt Browser preserves the address bar URL of the target domain (e.g., Gmail.com) even though the actual page content is attacker-controlled, the victim sees a trusted domain in the address bar while interacting with fraudulent content. The attack requires no special privileges beyond luring the victim to the attacker's webpage.

The vulnerability resides in the address bar handling logic of Bolt Browser version 1.4 and prior. The researcher's proof of concept uses JavaScript's `window.location.assign()` combined with `document.write()` and `setInterval()` to manipulate the displayed URL without a corresponding page load [ref_id=1]. No specific source file or function name is identified in the advisory.

The advisory does not include a patch or specific remediation from the vendor. The researcher notes that disclosure was handled through Rapid7 and that a 60-day timeframe was assigned for fixes, but no update addressing this specific vulnerability in Bolt Browser has been published [ref_id=1]. Without a patch, the recommended mitigation is to ensure the browser's address bar accurately reflects the true origin of loaded content after any navigation or script-driven URL change.