Chrome on alert: the failure in Service Workers that turns your browser into a silent bot

A Chromium failure discovered by the researcher Lyra Rebane and documented in the Chromium error tracker has again revealed a double failure: a vulnerability in the execution of Service Workers that can keep JavaScript active even with the closed browser, and an internal patch management that leaked sensitive information before deploying an effective correction. According to the researcher, an attacker can create a website that records a Service Worker that never ends and thus convert browsers into silent members of a remote network of bots capable of doing traffic proxy or participating in service denial attacks.

Public exposure of technical details accelerated risk. Part of the problem was not only the existence of the bug, but the administrative follow-up in Chromium marked the incidence as "fixed" in the system before the correction really reached the users, and then it was opened again. During the time the details became accessible, researchers and observers were able to validate that the explosion was still effective in Dev versions of Chromium browsers, which facilitated its reproduction.

It is important to stress that, according to Rebane and subsequent analysis, vulnerability does not seem to break the perimeter borders of the browser: it does not give direct access to local files, mail or the operating system. However, allows persistent JavaScript execution with maintained network connectivity, which is sufficient to mount proxies, amplify traffic or maintain communication with a command center, causing significant impact on scale if it is exploited massively.

To understand the technique it is useful to review how Service Workers work: they are scripts that act between the network and the website to manage cache, notifications and background processes. The technical documentation in MDN offers a good starting point for those who want to deepen their design and risks: https: / / develop.mozilla.org / en-US / docs / Web / API / Service _ WorkER _ API. For the journalistic and technical context on filtration and the current situation, Ars Technica collected reproducible statements and evidence: https: / / arstechnica.com / security / 2026 / 05 / google-publishes-exploit-code-amenatening-milllions-of-chromium-users /.

What can users do today to reduce the risk while an official patch arrives? First of all, disable the option that allows you to run background applications when the browser is closed(Chrome: Settings → System → "Continue running background applications when Google Chrome is closed"; Edge has an equivalent option in Settings → System). Second, to clean and revoke Service Workers from sites that are not trusted: this can be managed from the developer tools (DevTools → Application → Service Workers) or from site data management in the browser configuration, and also by clicking: / / inspection / # service-workers in Chromium browsers to inspect active workers.

Complementing the hygiene of the browser with robust content blockers, such as uBlock Origin, and avoiding the execution of scripts from unverified sites reduces the likelihood of initial infection. For high-risk navigation it is recommended to use separate profiles or guest mode, and consider browsers that do not share the same Chromium engine for experimental sessions. In corporate environments, it is urgent to implement group policies that disable background execution and block suspicious domains at firewall level until firm updates arrive.

From a response and detection perspective, security teams should monitor abnormal patterns of outgoing traffic from workstations that match bots behaviors (persistent connections to unusual domains, regular peaks of HTTP requests from browsers). EDR solutions and network detection systems can generate useful signals to identify committed customers; in medium and large organisations it is appropriate to prepare rules to block or isolate affected equipment while the cause is verified.

The filtration also leaves an organizational lesson: coordination between vulnerability identification, internal process labelling and controlled reporting is as critical as the technical patch. Marking an incidence as solved without deploying the arrangement or opening the information before time creates avoidable operating windows. Reward programs (VRP) should be incorporated into processes that ensure that changes in trackers do not reveal details before the correct code is released.

Finally, keep your browser and operating system up to date and keep an eye on the official Google and other Chromium browser maintainers to apply emergency updates. In the meantime, act with caution when visiting unknown sites and regularly review the Service Workers registered in your browser: such a check can make the difference between a healthy computer and one that acts silently as part of a malicious network.