Google publishes exploit code threatening millions of Chromium users

"Google on Wednesday published exploit code for an unfixed vulnerability in its Chromium browser codebase that threatens millions of people using Chrome, Microsoft Edge, and virtually all other Chromium-based browsers."

"The proof-of-concept code exploits the Browser Fetch programming interface, a standard that allows long videos and other large files to be downloaded in the background. An attacker can use the exploit to create a connection for monitoring some aspects of a user's browser usage and as a proxy for viewing sites and launching denial-of-service attacks. Depending on the browser, the connections either reopen or remain open even after it or the device running it has rebooted."

"The unfixed vulnerability can be exploited by any website a user visits. In effect, a compromise amounts to a limited backdoor that makes a device part of a limited botnet. The capabilities are limited to the same things a browser can do, such as visit malicious sites, provide anonymous proxy browsing by others, enable proxied DDoS attacks, and monitor user activity. Nonetheless, the exploit could allow an attacker to wrangle thousands, possibly millions, of devices into a network."

""The dangerous part here is that you can just have a lot of different browsers together that you can in the future run something on that you figure out," said Lyra Rebane, the independent researcher who discovered the vulnerability and privately reported it to Google in late 2022 in an interview. He said using the exploit code Google prematurely published would be "pretty easy," although scaling it to wrangle large numbers of devices into a single network would require more work."

Google published exploit code for an unfixed Chromium vulnerability affecting Chrome, Microsoft Edge, and other Chromium-based browsers. The proof-of-concept targets the Browser Fetch programming interface used to download large files in the background. An attacker can use the exploit to create connections that monitor aspects of browser usage and act as a proxy for viewing sites, while also enabling denial-of-service attacks. Depending on the browser, the connections may reopen or remain open after the browser or device reboots. The vulnerability can be triggered by any website a user visits and functions like a limited backdoor that adds devices to a limited botnet. The exploit could scale to thousands or millions of devices, and later vulnerabilities could enable full compromise.

Read at Ars Technica