Google’s Chromium Bug Leak Exposes Unfixed JavaScript Execution Flaw Google accidentally leaked details of an unfixed vulnerability in Chromium that allows JavaScript to run persistently in the background even after the browser is closed enabling remote code execution (RCE) on affected devices. The flaw, reported by security researcher Lyra Rebane in December 2022, was initially acknowledged but remains unresolved despite multiple attempts to patch it. The vulnerability stems from a malicious webpage exploiting a Service Worker to maintain active JavaScript execution. Attackers could use this to turn browsers into unwitting participants in a botnet, capable of launching DDoS attacks, proxying malicious traffic, or redirecting users to targeted sites. Rebane demonstrated that the exploit could silently persist in Microsoft Edge without triggering download prompts, making it harder to detect. The issue affects all Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Vivaldi, and Arc. Despite being marked as "fixed" in February 2024 under Google’s Vulnerability Rewards Program (VRP) with Rebane awarded a $1,000 bounty the patch was incomplete. On May 20, 2024, after the bug’s details were mistakenly made public, Rebane confirmed the exploit still worked in Chrome Dev 150 and Edge 148, calling it a "completely silent JS RCE" that activates from a single website visit. While the flaw does not bypass browser security boundaries or grant access to emails, files, or the host OS, its public exposure increases the risk of widespread exploitation. Google has since reclassified the issue as private, but the leak may accelerate the release of an emergency fix. No official response from Google has been provided as of publication.

Critical Zero-Click Vulnerability in Opera GX Exposes Users to Data Exfiltration A severe security flaw in Opera GX has been uncovered, allowing attackers to exploit the browser’s GX Mods feature for universal CSS injection, enabling cross-site data exfiltration without user interaction. Researcher zhero_web_security disclosed the vulnerability in 2026, demonstrating a zero-click attack chain that leverages automatic mod installation to compromise victims. ### How the Attack Works GX Mods Opera GX’s customization tool for themes, sounds, and CSS do not require explicit permissions or JavaScript execution, unlike traditional browser extensions. However, researchers found that mods packaged as .crx files are automatically installed when downloaded, even via silent methods like embedded iframes. Attackers can trigger this by luring victims to a malicious webpage, with no further interaction needed beyond visiting the site. Once installed, the malicious mod’s CSS is applied globally across all browser tabs, creating a universal injection vector. Using CSS-based data exfiltration (XS-Leaks), attackers can infer sensitive information such as email addresses by crafting selectors that trigger external requests when matched against DOM attributes. ### Exploitation in Practice The researchers demonstrated a real-world attack on Gmail addresses, using trigram-based reconstruction to extract email fragments. By generating 151,000 CSS rules targeting three-character sequences, the attack identifies substrings in HTML attributes (e.g., `[email protected]`). Matches trigger requests to attacker-controlled servers, which then reassemble the data using an overlap-based algorithm, reliably reconstructing the original string in a single page load. The attack is fully automated: after mod installation, the victim is redirected to a target page (e.g., a Google account endpoint), where the injected CSS exfiltrates data before the user can react. ### Additional Impact: Denial-of-Service Beyond data theft, the researchers identified a DoS vulnerability affecting both Opera GX and standard Opera browsers. Triggering a .crx download in Incognito mode causes the browser to crash and restart, resulting in complete session loss due to flawed extension installation handling in private browsing. ### Response and Implications Opera addressed the vulnerabilities following responsible disclosure through its bug bounty program. The findings underscore the risks of non-traditional extension mechanisms, particularly those allowing automatic installations and global styling, which can be weaponized for large-scale attacks. The incident highlights the need for stricter controls over browser customization features to prevent similar exploits.

Google Releases Exploit Code for Unpatched Chromium Vulnerability, Exposing Millions to Botnet Risks Google has published proof-of-concept (PoC) exploit code for a critical, unpatched vulnerability in the Chromium codebase, leaving users of Chrome, Microsoft Edge, Brave, Opera, and other Chromium-based browsers vulnerable to stealthy botnet-style attacks. The flaw, reported in late 2022 by security researcher Lyra Rebane, remains unresolved after more than 42 months, despite its Priority 1 (P1) and Severity 2 (S2) classification within Chromium’s internal framework. The vulnerability resides in the Browser Fetch API, which allows large downloads to continue in the background via Service Workers. Rebane discovered that this mechanism can be abused to create persistent, never-terminating background tasks that maintain continuous communication with attacker-controlled infrastructure. In some cases particularly with Microsoft Edge the connection persists even after the browser is closed or the device is rebooted, effectively turning a victim’s browser into a limited botnet node with zero user interaction required. ### Attack Mechanics & Risks The exploit is triggered when a user visits a malicious or compromised webpage, which deploys a Service Worker to initiate an unending background fetch task. This enables remote JavaScript execution on the victim’s device without visible indicators. Rebane warned that attackers could easily scale this attack, potentially compromising tens of thousands of devices without users’ knowledge. While browser sandboxing limits immediate damage, the vulnerability poses significant risks at scale, including: - DDoS attacks – Compromised browsers can flood targets with traffic. - Proxy networks – Attackers can route malicious or anonymized traffic through victim devices. - Traffic redirection – Users can be silently redirected to attacker-controlled sites. - Activity monitoring – Passive tracking of browsing behavior and network telemetry. The long-term concern is that a pre-established botnet of compromised browsers could serve as a launchpad for future exploits once additional vulnerabilities are discovered. ### Criticism & Current Status Google’s decision to release the PoC before issuing a fix has drawn criticism from the security community. While Chromium developers acknowledged the flaw as a “serious vulnerability”, no complete patch has been deployed. With the exploit code now public, Rebane noted that exploitation is “pretty easy”, though scaling attacks would require additional infrastructure. ### Affected Platforms & Mitigations The vulnerability impacts: - Google Chrome - Microsoft Edge - Brave Browser - Opera - Other Chromium-based browsers Until an official patch is released, security teams are advised to: - Restrict Service Worker usage via enterprise policies. - Disable background fetch features where possible. - Monitor for anomalous outbound browser connections. - Implement browser isolation in high-risk environments. With no patch in sight, the flaw presents an active, exploitable window for threat actors seeking large-scale browser-based botnet infrastructure.