Summary: Google released exploit code for a 29-month-old Chromium vulnerability, affecting millions of users. The flaw allows attackers to create persistent connections, potentially leading to botnet-like behavior.

Google has released exploit code for a long-standing vulnerability in the Chromium browser, putting millions of users of Chrome, Microsoft Edge, and other Chromium-based browsers at risk. The flaw, which was reported 29 months ago, has now been made public before a patch was issued, raising concerns about security practices and response times.

The vulnerability exploits the Browser Fetch API, a standard used to download large files like videos in the background. Attackers can leverage this flaw to establish persistent connections that monitor user activity, act as proxies for viewing websites, or even launch denial-of-service attacks. What makes this issue particularly alarming is that these connections can persist even after a browser or device restarts, effectively turning affected devices into parts of a limited botnet.

While the exploit’s capabilities are constrained by what a browser can do—such as visiting malicious sites or enabling proxy-based DDoS attacks—the potential scale of impact is enormous. With billions of Chromium-based users worldwide, a single exploit could compromise thousands, if not millions, of devices. Once another vulnerability is discovered, attackers could use this existing foothold to escalate their control across a vast network of compromised systems.

Google has since addressed the issue, but the timing of the exploit release has sparked debate within the cybersecurity community. Critics argue that releasing proof-of-concept code before a fix is deployed may put users at unnecessary risk, especially when the vulnerability has remained unpatched for nearly two and a half years.

Tags: #Cybersecurity #Chromium #TechSecurity #BrowserVulnerability

Source: https://arstechnica.com/security/2026/05/google-publishes-exploit-code-threatening-millions-of-chromium-users/