Google’s Chromium Bug Leak Exposes Unfixed JavaScript Execution Flaw Google accidentally leaked details of an unfixed vulnerability in Chromium that allows JavaScript to run persistently in the background even after the browser is closed enabling remote code execution (RCE) on affected devices. The flaw, reported by security researcher Lyra Rebane in December 2022, was initially acknowledged but remains unresolved despite multiple attempts to patch it. The vulnerability stems from a malicious webpage exploiting a Service Worker to maintain active JavaScript execution. Attackers could use this to turn browsers into unwitting participants in a botnet, capable of launching DDoS attacks, proxying malicious traffic, or redirecting users to targeted sites. Rebane demonstrated that the exploit could silently persist in Microsoft Edge without triggering download prompts, making it harder to detect. The issue affects all Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Vivaldi, and Arc. Despite being marked as "fixed" in February 2024 under Google’s Vulnerability Rewards Program (VRP) with Rebane awarded a $1,000 bounty the patch was incomplete. On May 20, 2024, after the bug’s details were mistakenly made public, Rebane confirmed the exploit still worked in Chrome Dev 150 and Edge 148, calling it a "completely silent JS RCE" that activates from a single website visit. While the flaw does not bypass browser security boundaries or grant access to emails, files, or the host OS, its public exposure increases the risk of widespread exploitation. Google has since reclassified the issue as private, but the leak may accelerate the release of an emergency fix. No official response from Google has been provided as of publication.

Critical Zero-Day Vulnerability in Google Chrome Exploited in the Wild A newly discovered zero-day vulnerability in Google Chrome, tracked as CVE-2026-5281, is under active exploitation, posing severe risks to users globally. The flaw, a Use-After-Free (UAF) bug in Google Dawn an open-source WebGPU implementation allows attackers to bypass security protections and execute arbitrary code on affected systems. The vulnerability was added to the Known Exploited Vulnerabilities (KEV) catalog on April 1, 2026, prompting urgent calls for updates. Exploitation requires tricking a victim into visiting a malicious HTML page, which triggers the UAF bug, enabling attackers to compromise the system, steal data, or deploy malware. For enterprises, a single compromised browser could serve as an entry point for lateral movement across networks. While the advisory focuses on Google Chrome, the flaw affects all Chromium-based browsers, including Microsoft Edge, Opera, Vivaldi, and Brave, due to its presence in the underlying engine. Security researchers have not yet confirmed whether the vulnerability is being used in ransomware campaigns, but its active exploitation elevates it to a high-priority threat. The Cybersecurity and Infrastructure Security Agency (CISA) has mandated Federal Civilian Executive Branch (FCEB) agencies to mitigate the risk by April 15, 2026, under Binding Operational Directive (BOD) 22-01. Organizations and users are advised to apply vendor-provided patches immediately, prioritize browser updates in patch management cycles, and discontinue use of unpatched versions if mitigations are unavailable.

Google Patches Actively Exploited Chrome Zero-Day (CVE-2026-2441) On February 16, 2026, Google released an emergency security update to address CVE-2026-2441, a high-severity zero-day vulnerability in Chrome actively exploited in the wild. The flaw, classified as a use-after-free bug in the browser’s CSS component, allows remote attackers to execute arbitrary code within a sandbox via a maliciously crafted HTML page. The vulnerability was discovered and reported by security researcher Shaheen Fazim on February 11, 2026. While Google confirmed the existence of an exploit, details about the threat actor or attack methods remain undisclosed. This marks the first actively exploited Chrome zero-day of 2026, following eight similar vulnerabilities patched in 2025. The update (Chrome 145.0.7632.75/76 for Windows and Mac, 144.0.7559.75 for Linux) is rolling out globally over the coming days. Users of Chromium-based browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, are advised to apply updates as they become available. The flaw’s severity underscores the ongoing risk of browser-based attacks, particularly those leveraging memory corruption vulnerabilities. No additional technical or attribution details have been released.