A Google Company inadvertently made a public report available (public copy), containing a detailed explanation and an example of an exploit for a vulnerability that has not yet been fixed in the Chromium engine. The vulnerability is considered dangerous, and the researcher who discovered the issue was awarded $1000. Information about the problem was submitted back in 2022 and has since been raised occasionally, but discussions regarding its resolution (which required the implementation of new limits on continuous loading) were never completed. In one such discussion, developers mistakenly believed the vulnerability was fixed and opened public access to information, despite the issue remaining unresolved.
The vulnerability allows for the continued execution of a background JavaScript handler (Service Worker) even after the browser window is closed, giving an attacker the ability to maintain constant control over the browser with the capability to load and execute their own JavaScript code at any moment within the context of their page. The attack scenario is that the attacker can get their page opened in a browser version that does not contain vulnerabilities, after which they can wait for a serious browser vulnerability to be discovered and execute the exploit without the user having to reopen the attacker's page. The essence of the method involves creating a page with a Service Worker that performs a data loading operation that is never interrupted.
According to the researcher who discovered the issue, the vulnerability could be leveraged to create a botnet from browsers whose users are unaware that, once established, the attacker can remotely execute JavaScript code on their device without any action required on their part. Such a botnet, even without exploiting other vulnerabilities, could be used to organize DDoS attacks and proxy malicious traffic through the victims' systems. The problem affects all browsers based on the Chromium engine.
Fonte: opennet.ru
