Google briefly exposed details of an unfixed Chromium bug that can keep background scripts alive

Reports this week describe a Chromium issue that can keep JavaScript running in the background—even after the browser is closed—via Service Workers and related background features. The problem affects Chromium-based browsers such as Chrome, Edge, Brave, Opera, Vivaldi, and Arc, and details about it were inadvertently made public before a patch was available.

BleepingComputer reports that Google “accidentally leaked” information about the unfixed issue, originally reported by security researcher Lyra Rebane and acknowledged as valid in December 2022. According to the report, a malicious webpage could register a Service Worker (for example, using a download task) that never terminates, enabling ongoing JavaScript execution on a visitor’s device even after the browser window closes. The same coverage notes that exploitation could be used to proxy traffic, redirect users, or contribute to distributed denial-of-service (DDoS) activity across many affected browsers. BleepingComputer also describes an internal status shuffle in early February that marked the bug as fixed without a shipped patch, after which access restrictions on the Chromium issue appeared to have been lifted, exposing additional details (source: BleepingComputer).

Ars Technica reports that Google also published proof-of-concept exploit code before a patch was available. Their write-up says the technique abuses the Browser Fetch interface to establish long-lived background connections that can proxy traffic, monitor some aspects of browsing, or help launch DoS attacks. Behavior may vary by browser: depending on the implementation, connections could remain open or reopen even after the browser—or the device—restarts. Ars characterizes the risk as a kind of limited backdoor constrained to browser-level capabilities and quotes the reporter, Lyra Rebane, as saying the proof-of-concept would be easy to use, though large-scale abuse would be harder (source: Ars Technica).

What’s confirmed vs. still unclear

• Confirmed by the cited reports: details about an unfixed Chromium issue became public; the bug involves Service Workers and background fetching that can keep JavaScript active after the browser is closed; the impact spans multiple Chromium-based browsers; potential misuse includes proxying, redirection, and DDoS-style activity; Google-published proof-of-concept code was mentioned by Ars Technica.
• Still unclear from the available evidence: the exact current patch status across different Chromium-based browsers and versions; any official mitigations or workarounds for end users or enterprises; the full scope of real-world exploitation, if any.

Why it matters

Chromium underpins the majority of desktop browsers. A flaw that enables persistent background activity from a site you visit expands the window for abuse, even if it is limited to what a browser can normally do. Public exposure of technical details and proof-of-concept code before patches land can increase the likelihood of opportunistic misuse.

Practical next steps

The sources do not provide a confirmed fix or vendor-recommended mitigations at this time. A practical approach is to:

• Monitor security advisories from Google Chrome and other Chromium-based browser vendors and apply updates promptly once available.
• Be cautious with unfamiliar or untrusted sites until patches ship, especially in high-risk environments.

Caveats and context

Based on the reporting, this issue centers on web platform features—Service Workers and background fetching—that are designed for legitimate use cases like background syncing and downloads. The described abuse keeps activity going longer than users might expect. However, the capabilities remain bounded by the browser’s security model; there is no evidence in these sources of arbitrary native-code execution beyond the browser context. Behavior may also differ between browsers, which could affect both risk and remediation once patches are available.

For more detail, see the reports from BleepingComputer and Ars Technica.

Alex Mira

Alex Mira is a fictitious AI-assisted author created for the Toolslib blog. Designed to support cybersecurity education, Alex writes about malware trends, software utilities, privacy practices, Windows internals, and practical defensive workflows. Articles published under Alex’s name are generated or assisted by AI and reviewed according to Toolslib’s editorial standards before publication.