Google Publishes Exploit Code for Unfixed Chromium Vulnerability

Google on Wednesday published exploit code for an unfixed vulnerability in its Chromium browser codebase. The code targets the Browser Fetch programming interface, which allows long videos and other large files to be downloaded in the background. An attacker can use the exploit to monitor aspects of a user's browser usage and to act as a proxy for viewing sites and launching denial-of-service attacks.

Depending on the browser, the connections either reopen or remain open even after the browser or device has rebooted.

The unfixed vulnerability can be exploited by any website a user visits. A compromise amounts to a limited backdoor that makes a device part of a limited botnet. The capabilities are limited to actions a browser can perform, such as visiting malicious sites, providing anonymous proxy browsing, enabling proxied denial-of-service attacks, and monitoring user activity.

Lyra Rebane, the independent researcher who discovered the vulnerability and privately reported it to Google in late 2022, said the exploit code Google published would be "pretty easy" to use. He added that scaling it to control large numbers of devices would require more work.

Its severity was rated S1, the second-highest classification. The vulnerability remained unknown except to Chromium developers until it was published to the Chromium bug tracker on Wednesday morning. Rebane initially assumed the vulnerability was finally fixed.

Shortly thereafter, he learned that it remained unpatched. Google removed the post, but it remains available on archival sites along with the exploit code. Google representatives did not immediately respond to an email asking how and why the vulnerability and exploit code were published and if or when a fix would become available.

Rebane confirmed that Brave, Opera, Vivaldi, and Arc are also vulnerable. Both Firefox and Safari are unaffected because they do not support the browser-fetching feature. Users of Chromium browsers should be suspicious of download dropdowns that appear for no reason.