# Google Accidentally Exposes Details of Unfixed Chromium Flaw That Enables Silent Browser Botnets


On May 20, 2026, Google inadvertently disclosed security details for a critical vulnerability affecting billions of Chromium-based browsers worldwide. The flaw, discovered in 2022 and falsely marked as fixed earlier this year, allows attackers to execute arbitrary JavaScript code that persists even after the browser is closed—without any user interaction. The accidental exposure of the vulnerability details significantly increases the risk of large-scale exploitation.


The vulnerability, reported by security researcher Lyra Rebane, enables attackers to transform browsers into permanent members of distributed botnets, capable of launching denial-of-service attacks, proxying malicious traffic, and silently exfiltrating network resources. The incident highlights critical gaps in Google's vulnerability management processes and raises urgent questions about patch validation across Chromium's vast ecosystem.


## The Threat: Silent JavaScript Execution at Scale


The core vulnerability exploits a fundamental flaw in how Chromium handles Service Workers—background processes that continue running even after a user closes their browser. An attacker can craft a malicious webpage containing a Service Worker configured to execute arbitrary JavaScript indefinitely, with no visible indication to the user.


Key exploitation characteristics:


  • No user interaction required — Simply visiting a compromised website once is sufficient
  • Complete invisibility — In Microsoft Edge, the exploit triggers silently with no download popup or other user notification
  • Cross-browser impact — Affects Google Chrome, Microsoft Edge, Brave, Opera, Vivaldi, Arc, and any other Chromium-based browser
  • Persistent execution — JavaScript continues running in the background even after the browser window is closed
  • Network access — Provides attackers with the ability to issue outbound requests from the victim's network

    • According to Rebane's research, the implications are staggering. "It's realistic to get tens of thousands of pageviews for creating a 'botnet,' and people won't be aware that JavaScript can be remotely executed on their device," she stated in her original 2022 bug report.


    ## Background and Context: A Four-Year Journey to Disclosure


    Lyra Rebane first reported this vulnerability to Google in 2022, demonstrating that JavaScript could run persistently in the background—behavior that should not be possible in a properly functioning browser. Google's vulnerability tracking system assigned the issue a severity classification, and the responsible disclosure process began.


    For over two years, the issue remained unresolved despite being flagged as a serious vulnerability. By October 2024, a Google developer noted the bug was still open and described it as a "serious vulnerability" requiring immediate attention. Despite this acknowledgment, no patch was released.


    The timeline of mismanagement:


    | Date | Event |

    |------|-------|

    | December 2022 | Vulnerability reported and acknowledged as valid |

    | October 26, 2024 | Google developer flags issue as "serious vulnerability" |

    | February 10, 2026 | Issue marked as fixed, then immediately reopened |

    | February 12, 2026 | Issue marked as fixed again; researcher awarded $1,000 bounty |

    | May 20, 2026 | Access restrictions automatically removed; details become public |

    | May 21, 2026 | Researcher confirms exploit still functional in Chrome Dev 150 and Edge 148 |


    The February "fix" followed a peculiar sequence: the issue was marked resolved, then quickly reopened due to "several concerns," only to be marked fixed again two days later. Critically, this closure occurred *without* shipping an actual patch to end users.


    ## Technical Details: How the Exploit Works


    The vulnerability leverages Chromium's Service Worker API, a web standard designed to enable offline functionality and background synchronization. When properly implemented, Service Workers should terminate when the browser closes. However, this vulnerability allows a malicious Service Worker to persist indefinitely.


    Attack mechanism:


    An attacker creates a webpage containing a Service Worker that performs a benign-looking action, such as initiating a download task. The Service Worker registers itself to continue running even after the user closes their browser. Once installed, the Service Worker can:


  • Execute arbitrary JavaScript code at any time
  • Make outbound HTTP/HTTPS requests to attacker-controlled command-and-control (C2) servers
  • Respond to commands from the C2 server
  • Perform actions that simulate legitimate user activity
  • Operate with the network context and permissions of the victim's computer

    • The exploit becomes significantly more dangerous in Microsoft Edge, where the download dialog—a visible indicator of suspicious activity—no longer appears in recent versions, rendering the attack completely silent and undetectable without examining browser developer tools or network logs.


    Implications of the technical flaw:


  • Botnet formation — Thousands of infected browsers can be coordinated for DDoS attacks, cryptocurrency mining, or data exfiltration
  • Traffic manipulation — Attackers can redirect outbound traffic, intercept unencrypted communications, or proxy requests through victim networks
  • Lateral movement — Infected browsers could be used to scan internal networks or attack other systems on the same network
  • Attribution obfuscation — Malicious activity appears to originate from thousands of legitimate user networks globally

    • Importantly, Rebane clarified that the vulnerability does not breach browser sandboxing protections and cannot directly access the victim's files, emails, or operating system. However, the ability to execute JavaScript and make network requests is sufficient for sophisticated attacks.


    ## The Accidental Exposure: How Details Went Public


    Google's Chromium Issue Tracker automatically removes access restrictions on vulnerability reports 14 weeks after they are marked as fixed—a policy designed to eventually make resolved issues public. When the tracker removed restrictions on May 20, 2026, it exposed all technical details of the exploit.


    On the same day, Rebane tested Google's claimed fix and discovered it did not work. The vulnerability remained present in Chrome Dev 150 and Microsoft Edge 148. She immediately notified the public on Mastodon, warning that the exposure would make exploitation "pretty easy."


    This created a dangerous window: the vulnerability details are now publicly available, attackers have clear technical documentation, and most critically, *no functional patch exists in production browsers yet*. Google marked the issue as fixed in its tracking system without actually shipping a working solution to users.


    ## Implications for Organizations and Users


    The scale of this vulnerability cannot be overstated. Chromium-based browsers account for approximately 65% of global browser market share, affecting billions of devices worldwide.


    Risk categories:


  • Enterprise networks — Compromised employee browsers become persistent backdoors into corporate networks, capable of pivoting to internal systems
  • Service providers — Attackers can target customers of major service providers, turning their browsers into proxies for malicious traffic
  • Cloud infrastructure — Browsers running in cloud environments could be weaponized to attack other cloud-hosted services
  • Critical infrastructure — Organizations relying on Chromium browsers for operational technology could face coordinated botnet attacks

    • Organizations cannot meaningfully mitigate this vulnerability through configuration or security controls until Google releases a functional patch. Users cannot determine if they are infected without specialized technical knowledge.


    ## Recommendations for Defense


    Immediate actions for security teams:


    1. Patch urgently — Monitor Chrome and Chromium-based browser updates closely. When Google releases a patch, deploy it immediately across all systems

    2. Monitor network traffic — Implement enhanced network monitoring for suspicious outbound connections, particularly to unfamiliar IP addresses or domains

    3. Restrict browser-based access — Where feasible, restrict the browsing of untrusted or high-risk websites on critical systems

    4. Enable Enterprise features — Organizations using Chrome for Business should enable advanced threat protection and monitoring features

    5. Consider alternatives temporarily — For critical operations, consider temporarily using non-Chromium browsers (Firefox, Safari) until patches are verified


    For researchers and reporters:


    The handling of this vulnerability raises questions about Google's responsible disclosure processes. The accidental public disclosure, combined with the lack of a working patch for months after claiming one existed, represents a significant failure in security management.


    ## HackWire Analysis


    This incident exposes a critical vulnerability in Google's vulnerability management and disclosure processes—ironically, more damaging than the technical flaw itself. Google marked a security issue as fixed without actually fixing it, then allowed automatic processes to expose the vulnerability details to the world while production patches remained unavailable.


    The real story isn't the exploit; it's the confidence gap. Researcher Lyra Rebane did everything right: reported responsibly in 2022, worked through Google's disclosure process, and trusted that a "fixed" status meant a real patch had shipped. Instead, Google's internal systems created a false sense of security while the vulnerability remained exploitable.


    What distinguishes this from typical zero-day incidents is the *preventability*. This wasn't a sophisticated attack or an undiscovered flaw. This was a known vulnerability that Google claimed to fix in February 2026, only for the researcher to confirm in May that it remained functional. Someone made a decision to mark the bug as fixed without verification. That's a process failure, not a technical one.


    The broader pattern is concerning: as vulnerability disclosure has become automated and at-scale, the human verification step—actually testing that a fix works—has seemingly become optional. When a "serious vulnerability" marked as fixed in February is still working in May, that suggests no one tested the fix before claiming victory.


    For defenders, the timeline is now critical. Details are public, researchers are actively testing the exploit, and attackers are likely already weaponizing it. Google will almost certainly treat this as urgent, but "urgent" in tech often means weeks, not days. Organizations dependent on Chromium should assume compromise is possible now and begin implementing network monitoring and access restrictions immediately.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)