Google Published Exploit Code for a Chromium Bug That Sat Untouched for 29 Months

Google did something bizarre this week: it published proof-of-concept exploit code for a Chromium vulnerability that has been sitting unfixed since late 2022. The exploit targets the Browser Fetch API — a standard designed to let web pages download large files like videos in the background — and turns it into a persistent backdoor. Visit any malicious site, and that script opens a service worker connection that survives reboots, stays open after the browser closes, and can be used as an anonymous proxy, a DDoS amplification source, or a staging point for future exploits. It was rated S1 by Chromium's own triage team — the second-highest severity classification — and Google's assigned developers apparently filed it into a folder and left it there for two and a half years.

The researcher who found it, Lyra Rebane, first reported it privately in late 2022 and assumed it was fixed months ago. She was wrong. According to Ars Technica's Dan Goodin, the exploit code only appeared on the Chromium bug tracker this Wednesday morning — and Google promptly removed it after people started noticing. The reason for the delay, Rebane suspects, is that the vulnerability falls outside any clearly defined security boundary. It doesn't let an attacker read your emails, access your hard drive, or escalate to system-level code. It just turns your browser into a zombie proxy. To a developer triaging hundreds of bugs, that might not look like an emergency. To the people who use Edge, Brave, Opera, Vivaldi, and Arc — all of which inherit this vulnerability from the shared Chromium codebase — it looks like 29 months of quietly rotting infrastructure with an exploit now sitting in plain sight on a public bug tracker. Chrome users on average complete about 17 background fetches per day, which means the attack surface is real even if the current exploitation rate is near zero. Firefox and Safari are unaffected because they don't implement Browser Fetch, a detail that makes you wonder why Chromium's defenders were so relaxed about a feature their competitors explicitly rejected.

Source image 1

The real question isn't whether this exploit can be abused — obviously it can, the code is public now. It's why Google's bug triage process lets an S1-rated vulnerability age into irrelevance for nearly three years while the patch queue moves on to flashier targets. Something about how severity is defined in the Chromium threat model clearly doesn't align with what external researchers think matters, and that misalignment is what cost us 29 months. You can almost hear the internal logic: this isn't a real security boundary violation, so it's a medium priority, let it queue. Except the queue was full and nothing ever pulled it forward. If your browser is part of the Chromium family, you should probably pay attention to unexplained download dropdowns appearing on random pages. That's your early warning sign. And enterprise admins managing Chromium deployments should probably check whether their baseline policies account for persistent service workers that weren't there yesterday.