Google Releases Exploit Code for Unpatched Chromium Vulnerability, Exposing Millions to Botnet Risks Google has published proof-of-concept (PoC) exploit code for a critical, unpatched vulnerability in the Chromium codebase, leaving users of Chrome, Microsoft Edge, Brave, Opera, and other Chromium-based browsers vulnerable to stealthy botnet-style attacks. The flaw, reported in late 2022 by security researcher Lyra Rebane, remains unresolved after more than 42 months, despite its Priority 1 (P1) and Severity 2 (S2) classification within Chromium’s internal framework. The vulnerability resides in the Browser Fetch API, which allows large downloads to continue in the background via Service Workers. Rebane discovered that this mechanism can be abused to create persistent, never-terminating background tasks that maintain continuous communication with attacker-controlled infrastructure. In some cases particularly with Microsoft Edge the connection persists even after the browser is closed or the device is rebooted, effectively turning a victim’s browser into a limited botnet node with zero user interaction required. ### Attack Mechanics & Risks The exploit is triggered when a user visits a malicious or compromised webpage, which deploys a Service Worker to initiate an unending background fetch task. This enables remote JavaScript execution on the victim’s device without visible indicators. Rebane warned that attackers could easily scale this attack, potentially compromising tens of thousands of devices without users’ knowledge. While browser sandboxing limits immediate damage, the vulnerability poses significant risks at scale, including: - DDoS attacks – Compromised browsers can flood targets with traffic. - Proxy networks – Attackers can route malicious or anonymized traffic through victim devices. - Traffic redirection – Users can be silently redirected to attacker-controlled sites. - Activity monitoring – Passive tracking of browsing behavior and network telemetry. The long-term concern is that a pre-established botnet of compromised browsers could serve as a launchpad for future exploits once additional vulnerabilities are discovered. ### Criticism & Current Status Google’s decision to release the PoC before issuing a fix has drawn criticism from the security community. While Chromium developers acknowledged the flaw as a “serious vulnerability”, no complete patch has been deployed. With the exploit code now public, Rebane noted that exploitation is “pretty easy”, though scaling attacks would require additional infrastructure. ### Affected Platforms & Mitigations The vulnerability impacts: - Google Chrome - Microsoft Edge - Brave Browser - Opera - Other Chromium-based browsers Until an official patch is released, security teams are advised to: - Restrict Service Worker usage via enterprise policies. - Disable background fetch features where possible. - Monitor for anomalous outbound browser connections. - Implement browser isolation in high-risk environments. With no patch in sight, the flaw presents an active, exploitable window for threat actors seeking large-scale browser-based botnet infrastructure.

The Opera Sync service may have been compromised, according to a security notice released by Opera for its users. Opera made every Sync user who received notice by mail of questionable activity with their accounts change their passwords in reaction to the purported incident. However, some information was discovered to have been accessed, including login names and passwords for some sync users. Opera made it clear that the system's authentication passwords are salted and hashed using per-user salts; yet, the business withheld details regarding the authentication passwords' hashing procedure.