Google Publishes Exploit Code for Unfixed Chromium Bug Exposing Millions of Users
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Google has publicly released proof-of-concept (PoC) exploit code for a critical, still-unpatched vulnerability in the Chromium codebase, potentially exposing millions of users across Chrome, Microsoft Edge, and other Chromium-based browsers<\/a> to stealthy botnet-style abuse.<\/p>\n The vulnerability, originally reported in late 2022 by independent security researcher Lyra Rebane, remains unfixed after more than 42 months. It has been assigned a Priority 1 (P1) rating, indicating high urgency and Severity 2 (S2), marking it as a serious security issue within Chromium\u2019s vulnerability classification framework.<\/p>\n The flaw resides in the Browser Fetch API, a feature designed to allow large downloads, such as videos or files, to continue in the background via Service Workers.<\/p>\n However, Rebane discovered that this mechanism can be abused to create persistent, never-terminating tasks that maintain continuous communication with attacker-controlled infrastructure.<\/p>\n By leveraging this behavior, attackers can establish a covert communication channel between a victim\u2019s browser and a command-and-control (C2) server<\/a>. Notably, in some implementations, such as Microsoft Edge, the connection may persist even after the browser is closed or the system is rebooted.<\/p>\n