Google Publishes Exploit Code for Unfixed Chromium Vulnerability
Similar Articles
Linux Vulnerability Dirty Frag Exploit Leaked, Hackers Testing in Wild
Linux Kernel Vulnerability Patched, Public Exploit Code Released
GitHub Confirms Software Supply Chain Attack Compromises Internal Code
Mozilla Details AI Tool That Found 271 Firefox Security Flaws in Two Months
Open Source CLI Package Compromised, Malicious Version Removed
Google has published proof-of-concept exploit code for a vulnerability in its Chromium browser codebase that has remained unfixed for 29 months. The flaw affects Chrome, Microsoft Edge, and other Chromium-based browsers, allowing malicious websites to create persistent connections that can monitor user activity or be used in denial-of-service attacks. The exploit code is now publicly available.
Facts First
- Google published exploit code for an unfixed vulnerability in the Chromium browser codebase.
- The flaw affects Chrome, Edge, and other Chromium-based browsers and has remained unpatched for 29 months.
- A malicious website can exploit the Browser Fetch interface to create a persistent connection.
- The exploit can monitor user activity and be used as a proxy for denial-of-service attacks.
- Connections can persist or reopen even after a browser or device reboot.
What Happened
Google published proof-of-concept exploit code on Wednesday for an unfixed vulnerability in its Chromium browser codebase. The vulnerability affects Chrome, Microsoft Edge, and virtually all other Chromium-based browsers. The exploit targets the Browser Fetch programming interface, which is a standard for downloading large files in the background. An attacker can use the exploit to monitor certain aspects of a user's browser usage, visit malicious sites, provide anonymous proxy browsing for others, enable proxied Distributed Denial-of-Service (DDoS) attacks, or potentially include thousands or millions of devices in a network. The vulnerability has remained unfixed for 29 months.
Why this Matters to You
If you use Chrome, Edge, or another Chromium-based browser, any website you visit could potentially exploit this vulnerability. This could allow a malicious site to monitor your browsing activity without your knowledge. The exploit could also use your device's connection as part of a larger network for launching denial-of-service attacks against other websites, which might slow down your internet connection or implicate your IP address in malicious activity. The persistent nature of the connection means the threat could remain active even after you close your browser or restart your computer.
What's Next
Google and other browser vendors are now aware of the public exploit code and are likely to prioritize developing and releasing a security patch. Until a fix is released, users of affected browsers may be at increased risk. You may want to be extra cautious about the websites you visit and consider using additional security software. The public disclosure of the exploit code could lead to more widespread testing and potentially more attacks before a patch is available.