Brave Privacy Browser has a backdoor to remotely inject headers in HTTP requests