Google publishes exploit code threatening millions of Chromium users

2026-05-21

Google accidentally exposed proof-of-concept code for a still-unpatched Browser Fetch API bug that can turn Chromium-based browsers into limited bots for proxying traffic, DDoS, and activity monitoring. Any visited site can trigger a persistent service worker, with behavior particularly stealthy on Edge. Chrome, Edge, Brave, Opera, Vivaldi, and Arc are affected. Firefox and Safari are not.