Loading story…
Security research demonstrated a Chrome-specific escalation path for cross-site scripting running inside a same-origin Web Worker. Although Web Workers lack DOM and many window APIs, injected code can still access sensitive same-origin resources; the research notes abuse paths involving Fetch API requests, insecure postMessage implementations, IndexedDB changes, browser-cache poisoning, and Cache Storage poisoning in applications using Service Workers.
The technique creates a same-origin blob: URL containing attacker-controlled HTML from the compromised worker, exposes that URL to an attacker-controlled site, and uses victim drag-and-drop interaction to navigate to it without a blocked cross-origin redirect. Opening the Blob URL executes the payload in a regular page context, restoring access to the DOM, localStorage, and standard window APIs; organizations should treat Worker-context XSS as potentially equivalent to page-context XSS and review cross-origin messaging, cache handling, and user-driven navigation flows.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A Chrome-specific technique was described in which an attacker with same-origin Web Worker XSS creates and leaks an HTML Blob URL, then uses victim drag-and-drop interaction to open it in a normal page context. The navigation escapes the Worker context and provides access to the DOM, localStorage, and normal window APIs.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a Chrome vulnerability that could bypass `SameSite=Strict` cookie protections when a target website had a registered service worker and a victim opened Chrome DevTools. A cross-site POST initially sent without cookies could be replayed by the Inspector Resource Content Loader using the invalid `kNoCors` and `kOnlyIfCached` combination; the target site's service worker could then refetch the request in its own origin context, causing Strict cookies to be attached. The flaw could enable CSRF-style actions, including unauthorized account or password changes and financial transfers. Chrome's Vulnerability Reward Program rated the report S3/P2 and fixed the issue by changing the loader request mode to `kSameOrigin` while retaining `kOnlyIfCached`. Researchers also reported a related cache and request-resubmission path involving Ctrl+U and page refresh behavior as Issue-470629629.
Sep 2, 2026
Google publicly released proof-of-concept exploit code for a long-unfixed Chromium vulnerability in the Browser Fetch API, exposing Chrome, Microsoft Edge, Brave, Opera, and other Chromium-based browsers to abuse by any malicious website a user visits. Researcher **Lyra Rebane** reported the flaw in late 2022, but it remained unresolved for years despite being internally classified as serious. The bug lets an attacker register a Service Worker and create a background fetch task that can persist as a covert communication channel, enabling browser monitoring, anonymous proxying, traffic redirection, and potential browser-based botnets; some implementations reportedly keep the connection alive even after the browser closes or the device reboots. At the same time, Google issued Chrome Stable Channel updates for versions before `148.0.7778.178/179`, and government and vulnerability trackers highlighted multiple newly disclosed flaws fixed in that release. Those included `CVE-2026-9120`, a high-severity WebRTC use-after-free that could allow remote code execution in the browser sandbox via a crafted HTML page; `CVE-2026-9126`, a DOM use-after-free with similar impact; and `CVE-2026-9121`, a GPU out-of-bounds read that could lead to heap corruption. The contrast between patched Chrome memory-corruption bugs and the still-unfixed Browser Fetch issue raised concern because the published exploit code lowers the barrier to abuse across millions of Chromium users, prompting recommendations to restrict Service Worker use, disable background fetch where possible, monitor outbound browser traffic, and consider browser isolation in enterprise environments.
Jun 29, 2026
Mozilla introduced `setHTML` in Firefox 148 as a safer alternative to `innerHTML`, using built-in HTML sanitization to reduce cross-site scripting (XSS) exposure when applications insert untrusted markup. The change aims to give developers a browser-native mechanism that avoids unsafe parsing and rendering patterns associated with direct HTML injection. Researchers also identified two XSS bypasses in Chrome 146's Sanitizer API implementation. One used SVG animation and the malformed namespaced attribute `xlink:href:x` to evade an attribute-blocking check; another allowed an invalid `javascript:` URL that GET-form URL rewriting converted into executable JavaScript. Chrome remediated both flaws in version 147, released April 7, 2026; organizations should ensure managed Chrome deployments are updated and treat browser sanitization APIs as defense-in-depth rather than a substitute for contextual output encoding and input controls.
Sep 3, 2026