Google accidentally exposed details of unfixed Chromium flaw
Patch Chromium to the latest stable version and disable background Service Workers.
Update all Chromium browsers to the latest patch, disable background Service Workers, and monitor for exploit activity.
Summary
Google inadvertently leaked details of an unfixed Chromium flaw that allows JavaScript to continue running in the background after the browser is closed, enabling remote code execution. The flaw is exploited via a malicious Service Worker that never terminates, affecting all Chromium‑based browsers, including Chrome, Edge, Brave, Opera, Vivaldi, and Arc. The issue was reported in December 2022, marked fixed on February 12 2026, but the patch had not been shipped. On May 20 2026, Google removed access restrictions from the Chromium Issue Tracker, inadvertently exposing the flaw’s details. The exploit remains functional in Chrome Dev 150 and Edge 148, allowing attackers to launch DDoS attacks, proxy malicious traffic, or redirect traffic without user interaction. Google is expected to release emergency fixes soon.
Security teams should immediately update all Chromium browsers to the latest stable version, disable background Service Workers, and monitor for exploit activity to mitigate this risk.
Key changes
- Flaw allows JavaScript to run in background after browser closed, enabling remote code execution.
- Exploited via malicious Service Worker that never terminates.
- Affects all Chromium‑based browsers: Chrome, Edge, Brave, Opera, Vivaldi, Arc.
- Issue reported Dec 2022, marked fixed Feb 12 2026 but not shipped.
- Exposure occurred May 20 2026 after bug tracker access was removed.
- Exploit still works in Chrome Dev 150 and Edge 148.
- Potential for DDoS, proxying malicious traffic, redirecting traffic.
- Google likely to release emergency fixes soon.