Overview Google has inadvertently leaked details of an unpatched Chromium vulnerability that allows JavaScript code to continue running in the background even after the browser is closed. The flaw, first reported by security researcher Lyra Rebane in December 2022, could enable attackers to remotely execute persistent JavaScript on user devices, effectively turning browsers into stealthy botnet nodes.
The Vulnerability
- The bug involves Service Workers — background scripts designed to handle tasks like caching and downloads.
- Attackers can craft a malicious webpage that registers a Service Worker which never terminates, continuing to run even after the browser is closed.
- This allows remote code execution (RCE) through JavaScript, without user interaction.
Rebane explained: “It’s realistic to get tens of thousands of pageviews for creating a botnet, and people won’t be aware that JavaScript can be remotely executed on their device.”
Potential Exploitation Scenarios
- Distributed denial‑of‑service (DDoS) attacks launched from compromised browsers.
- Proxying malicious traffic through unsuspecting users.
- Redirecting traffic to attacker‑controlled sites.
The flaw impacts all Chromium‑based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Vivaldi, and Arc.
Timeline of Events
- Dec 2022: Bug reported by Rebane, acknowledged as valid.
- Oct 2024: Google developer flagged it as a “serious vulnerability” still unresolved.
- Feb 2026: Issue marked as fixed, then reopened due to concerns. A $1,000 bug bounty was awarded.
- May 20, 2026: Access restrictions lifted after 14 weeks, exposing details publicly.
- May 21, 2026: Rebane confirmed the flaw still exists in Chrome Dev 150 and Edge 148, noting it now operates even more stealthily (no download popup).
Risk and Impact
The exposure means attackers could weaponize the flaw more easily. While Rebane clarified that it does not bypass browser security boundaries or grant access to emails, files, or the host OS, the ability to silently run JavaScript after browser closure poses a significant risk to millions of users.
Google is expected to issue emergency fixes soon, given the scale of potential exploitation.
Defensive Recommendations
Until patches are released, organizations and users should:
- Monitor Google advisories for emergency updates.
- Restrict exposure to untrusted sites and avoid visiting suspicious domains.
- Use network monitoring to detect unusual outbound traffic.
- Deploy strict browser policies in enterprise environments to limit Service Worker behavior.
Strategic Insight
This incident highlights the risks of premature disclosure and the challenges of managing vulnerabilities in widely used open‑source projects. The fact that details were exposed before a fix was shipped underscores the importance of coordinated vulnerability handling and responsible disclosure timelines.
Final Thoughts
The Chromium Service Worker flaw could redefine how attackers build botnets — not through malware, but by hijacking browsers themselves. With billions of users relying on Chromium‑based browsers, Google’s next steps will be critical in preventing widespread abuse.
Leave a Reply