Loading story…
A critical vulnerability in the Blink rendering engine, affecting Chrome, Microsoft Edge, and other Chromium-based browsers, allows attackers to crash browsers within seconds by abusing the document.title API. Security researcher Jose Pino discovered the flaw, dubbed Brash, and published a proof-of-concept exploit after his responsible disclosure to Google went unanswered for two months. The exploit works by rapidly updating the document title millions of times per second, overwhelming the browser's main thread and causing a denial-of-service condition, with some tests even freezing the host system.
The vulnerability impacts at least nine major browsers across Android, macOS, Windows, and Linux, including Chrome, Edge, Opera, Vivaldi, and OpenAI's ChatGPT Atlas. With Chrome alone accounting for over three billion users, the scale of exposure is significant. Despite the public disclosure and demonstration of the exploit, Google and other affected vendors have not yet issued a patch or commented on the issue, raising concerns about their vulnerability response processes and the potential for widespread disruption until a fix is released.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Public reporting said the researcher published exploit details and attack methodology after Google had not yet issued a patch or responded. The write-up described a multi-phase attack flow and said the flaw affected Chromium-based browsers across major desktop platforms.
Security researcher Jose Pino disclosed a denial-of-service flaw dubbed 'Brash' in Chromium's Blink rendering engine. The issue abuses the document.title API to trigger massive DOM updates, causing CPU spikes, freezes, and browser crashes after a user visits a malicious URL.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecsoonline.com
Open sourcesecurityaffairs.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google publicly released proof-of-concept exploit code for a long-unfixed Chromium vulnerability in the Browser Fetch API, exposing Chrome, Microsoft Edge, Brave, Opera, and other Chromium-based browsers to abuse by any malicious website a user visits. Researcher **Lyra Rebane** reported the flaw in late 2022, but it remained unresolved for years despite being internally classified as serious. The bug lets an attacker register a Service Worker and create a background fetch task that can persist as a covert communication channel, enabling browser monitoring, anonymous proxying, traffic redirection, and potential browser-based botnets; some implementations reportedly keep the connection alive even after the browser closes or the device reboots. At the same time, Google issued Chrome Stable Channel updates for versions before `148.0.7778.178/179`, and government and vulnerability trackers highlighted multiple newly disclosed flaws fixed in that release. Those included `CVE-2026-9120`, a high-severity WebRTC use-after-free that could allow remote code execution in the browser sandbox via a crafted HTML page; `CVE-2026-9126`, a DOM use-after-free with similar impact; and `CVE-2026-9121`, a GPU out-of-bounds read that could lead to heap corruption. The contrast between patched Chrome memory-corruption bugs and the still-unfixed Browser Fetch issue raised concern because the published exploit code lowers the barrier to abuse across millions of Chromium users, prompting recommendations to restrict Service Worker use, disable background fetch where possible, monitor outbound browser traffic, and consider browser isolation in enterprise environments.
Jun 29, 2026
A serious unpatched **Chromium** vulnerability was accidentally exposed after Google engineers marked the issue as fixed without shipping a patch, causing the bug report and proof-of-concept to become public. The flaw, originally reported in 2022, abuses the **Background Fetch API** to keep a Service Worker and malicious JavaScript running after the browser is closed and, in some cases, even after a device reboot. Affected products include **Chrome**, **Microsoft Edge**, **Brave**, **Opera**, **Vivaldi**, and **Arc**. The bug could let attackers abuse victims’ browsers for proxying traffic, launching DDoS activity, opening websites, and tracking user behavior; Google later re-hid the report and said it is working on a fix. Separately, researchers analyzing the **VoidStealer** infostealer found it can bypass Chrome’s **Application-Bound Encryption (ABE)** on Windows by attaching to the browser as a debugger, intercepting the moment Chrome decrypts protected data, and extracting the master key from memory. That technique enables theft of cookies, sessions, and other sensitive browser data, and the risk extends to other Chromium-based browsers using the same protection model. Together, the disclosures show that Chromium ecosystems face both browser-level persistence abuse and post-compromise data theft, with defenders urged to watch for unusual download-menu behavior, keep browsers updated as fixes arrive, and harden endpoints against infostealer activity.
Jun 29, 2026
Google has patched **CVE-2026-11645**, an actively exploited flaw in Chrome’s V8 JavaScript and WebAssembly engine that can give attackers both out-of-bounds read and write capabilities from a crafted web page. The bug affects Chrome prior to **149.0.7827.103** on Windows and macOS and **149.0.7827.102** on Linux, creating a realistic drive-by compromise path in which renderer-process code execution could be chained with a sandbox escape for full device takeover. Public reporting notes that Google confirmed in-the-wild exploitation but did not disclose the campaign, attribution, or full exploit chain. The risk is amplified across the broader Chromium ecosystem because many **Electron** and Chromium-based applications ship their own embedded V8 runtimes and may remain vulnerable after browser updates. Historical Chromium issues and research around **XSS Auditor** and Chrome security bugs—including bypasses, cross-origin data extraction, form-data leakage through redirects, and Egor Homakov’s account of abusing Chrome bugs in an OAuth flow—underscore how browser flaws can expose sensitive data or be combined into larger attack chains. Organizations are being pushed to update Chrome immediately and inventory Chromium-derived applications that may require separate patch cycles.
Aug 16, 2026