Google published proof-of-concept exploit code on Wednesday for a vulnerability in its Chromium browser that has gone unfixed for 29 months. The flaw affects Chrome, Microsoft Edge, and other Chromium-based browsers used by millions worldwide. It enables attackers to establish persistent connections for monitoring user activity and launching attacks.
The exploit targets the Browser Fetch programming interface, which handles background downloads of large files. Once activated, it creates a service worker that can reopen connections even after browser or device restarts. This setup allows a compromised device to join a limited botnet for proxying traffic or enabling denial-of-service attacks without granting deeper system access.
