This Unpatched Chrome Flaw Could Be Secretly Turning Millions of Phones into Botnets

If you use Google Chrome or any other Chromium-based web browser, you may want to pay attention to this. According to a report by Ars Technica, Google had accidentally published the exploit code of the Chrome botnet flaw on its own bug tracker this week. Apparently, the vulnerability affects Chrome and several Chromium-based browsers and can turn any device you use for browsing into a botnet.

A security researcher first reported the Chrome botnet flaw three years back

This isn’t the first time this security vulnerability has surfaced in the wild. Apparently, it was privately reported back in late 2022 by independent security researcher Lyra Rebane. However, it still remains unpatched. As reported, the Chrome botnet flaw targets Chromium’s Background Fetch API. For those unaware, it’s a feature that helps browsers continue downloading large files in the background.

The researcher discovered that malicious websites could abuse the system to create persistent browser connections that survive browser restarts and, in some cases, even device reboots. That apparently opens the door to a lightweight browser-based botnet. The good news is that hackers reportedly can’t fully take over a device using this Chrome botnet flaw.

However, attackers can use compromised browsers as anonymous proxies, traffic relays, or even tools for DDoS attacks. Security researchers also warn that if the botnet flaw is combined with additional exploits, infected browser sessions could later become even more dangerous. While Google quickly removed the exploit code of the Chrome botnet flaw from its public bug tracker, archived copies reportedly remain online. It apparently also includes proof-of-concept code.

Delaying patch could make things worse

Considering the user base of Chromium-based browsers like Chrome, and more, the botnet flaw could affect billions of users worldwide. Since Firefox and Safari don’t use Chromium, both remain safer alternatives for now. Now that working exploit code is out in public, we expect Google to act soon and release a patch.

The post This Unpatched Chrome Flaw Could Be Secretly Turning Millions of Phones into Botnets appeared first on Android Headlines.