Google accidentally revealed public access to a report (public copy) containing detailed explanations and examples of an exploit for a vulnerability that has not yet been patched in the Chromium engine. The vulnerability is recognized as dangerous, and the researcher who discovered the issue was awarded $1000. Information about the problem was sent back in 2022 and has since been raised periodically, but discussions about its fix have not been completed (new limits on continuous loading were required). In one such discussion, developers mistakenly assumed the vulnerability was fixed and opened public access to the information, even though the issue remained unresolved.
The vulnerability allows for the continued execution of a background JavaScript handler (Service Worker) even after the browser window is closed, enabling an attacker to maintain constant control over the browser with the ability to load and execute their JavaScript code at any moment within their page's context. The attack scenario involves the attacker managing to open their page in a browser version that does not contain the vulnerabilities, after which they await the discovery of a serious vulnerability in the browser and organize the exploit's execution without requiring the user to reopen the attacker's page. The crux of the method is to create a page with a Service Worker that performs a data loading operation, which is never interrupted.
According to the researcher who discovered the issue, the vulnerability could be used to create a botnet of browsers, whose users are unaware that once compromised, the attacker can remotely execute JavaScript code on their device without any actions on their part. Such a botnet, even without exploiting other vulnerabilities, could be used to organize DDoS attacks and proxy malicious traffic through the victims' systems. The issue affects all browsers based on the Chromium engine.
Source: opennet.ru
