Google Exposed an Unpatched Chromium Browser Backdoor While Shipping Chrome Fixes

Google publicly released proof-of-concept exploit code for a long-unfixed Chromium vulnerability in the Browser Fetch API, exposing Chrome, Microsoft Edge, Brave, Opera, and other Chromium-based browsers to abuse by any malicious website a user visits. Researcher Lyra Rebane reported the flaw in late 2022, but it remained unresolved for years despite being internally classified as serious. The bug lets an attacker register a Service Worker and create a background fetch task that can persist as a covert communication channel, enabling browser monitoring, anonymous proxying, traffic redirection, and potential browser-based botnets; some implementations reportedly keep the connection alive even after the browser closes or the device reboots.

At the same time, Google issued Chrome Stable Channel updates for versions before 148.0.7778.178/179, and government and vulnerability trackers highlighted multiple newly disclosed flaws fixed in that release. Those included CVE-2026-9120, a high-severity WebRTC use-after-free that could allow remote code execution in the browser sandbox via a crafted HTML page; CVE-2026-9126, a DOM use-after-free with similar impact; and CVE-2026-9121, a GPU out-of-bounds read that could lead to heap corruption. The contrast between patched Chrome memory-corruption bugs and the still-unfixed Browser Fetch issue raised concern because the published exploit code lowers the barrier to abuse across millions of Chromium users, prompting recommendations to restrict Service Worker use, disable background fetch where possible, monitor outbound browser traffic, and consider browser isolation in enterprise environments.