# Unpatched Chromium Background Fetch / Service Worker Persistence Flaw — Silent Post-Close JavaScript Execution (Details Accidentally Leaked by Google)

> An unpatched vulnerability in Chromium's Background Fetch API lets any visited website register a Service Worker (via a background download task) that keeps JavaScript executing in the background after the browser is closed, and on some configurations even survives a device reboot. Independent researcher Lyra Rebane disclosed the bug to Google in late 2022; access restrictions on the Chromium Issue Tracker were lifted on 2026-05-20 after the bug was incorrectly marked fixed, briefly publishing exploit code and technical details before Google re-restricted the thread. The exploit still works on Chrome Dev 150, Edge 148, Brave, Opera, Vivaldi, and Arc — Firefox and Safari are not affected because they do not implement Background Fetch.

- **Published:** 2026-05-21T12:00:00Z
- **Last reviewed:** 2026-05-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0552
- **ID:** TL-2026-0552
- **Severity:** HIGH (CVSS 7.6)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Threadlinqs Intelligence is tracking TL-2026-0552, an unpatched persistence and abuse-of-functionality flaw in the Chromium Background Fetch programming interface (sometimes referred to as Browser Fetch / background download) that affects all Chromium-based browsers including Google Chrome, Microsoft Edge, Brave, Opera, Vivaldi, and Arc. Firefox and Safari do not implement Background Fetch and are not vulnerable.

The original report was filed to the Chromium Issue Tracker by independent security researcher Lyra Rebane in December 2022. Two Google developers acknowledged the report as a serious vulnerability; it was rated P1 (second-highest priority) and S2 (third-highest severity). The bug remained open for 42+ months. On 2026-02-10 the issue was marked fixed, reopened minutes later, then re-marked fixed on 2026-02-12 with a $1,000 Vulnerability Reward Program (VRP) bounty paid. No patch was ever shipped. Per Chromium policy, access restrictions on bugs closed for more than 14 weeks are automatically lifted, and on 2026-05-20 the entire issue thread — including exploit proof-of-concept code — became publicly visible. Rebane subsequently re-tested and confirmed on the same day that the exploit still works on current Chrome Dev 150 and Microsoft Edge 148; Google re-restricted the thread, but the contents had already been mirrored to archival sites.

Exploit mechanics. The bug abuses the Background Fetch API in conjunction with the Service Worker that handles fetch lifecycle events. A malicious page registers a Service Worker and initiates a Background Fetch download job (typically pointed at a slow or large resource). The Background Fetch operation is designed to outlive the page that created it so that long downloads can complete with the tab closed. However, the underlying Service Worker stays alive for the duration of the fetch and keeps executing JavaScript in its global scope — including arbitrary code that has nothing to do with the download. Because the fetch can be configured against a deliberately slow upstream (or one that streams indefinitely), the Service Worker effectively never terminates. The malicious JavaScript continues running with full Service Worker capabilities: fetch(), postMessage to other clients, push subscription handling, periodic sync, and IndexedDB access. On Chrome, a download dropdown appears momentarily and may persist; on current Edge the dropdown no longer renders at all, producing fully silent execution.

Persistence. The Service Worker is registered against the malicious origin and persists in the browser profile across normal browser shutdowns. When the browser is relaunched, push subscriptions, periodic background sync, and a re-triggered Background Fetch can re-invoke the worker without the user re-visiting the origin. Ars Technica reports that depending on the browser configuration the connection either reopens on next launch or remains open even after the host device has rebooted. Compromise therefore behaves as a limited browser-resident backdoor: it does not cross the browser sandbox, does not read host files or emails, and does not bypass Same-Origin Policy, but it does grant a long-lived JavaScript execution channel under the attacker's origin.

Abuse cases. Rebane's original report framed the bug as enabling permanent Chromium-based JS botnet recruitment with no further user interaction after a single page visit. With tens of thousands of pageviews on a malicious or compromised site, an attacker can amass a sizeable population of long-lived browser nodes. Operator capabilities include: (1) proxying malicious traffic through victim browsers, (2) launching application-layer DDoS via fetch() floods, (3) traffic redirection and SEO/click-fraud, (4) reconnaissance of victim browsing patterns through repeated origin probes, and (5) a staging platform — Rebane explicitly noted that if a separate browser sandbox escape becomes available, this persistent foothold could be used to deliver it broadly. In her own description: "In Edge, you wouldn't even notice anything out of place, and would stay connected to the C2 even after closing the browser."

Limitations. The vulnerability does not bypass the Chromium renderer sandbox or the Same-Origin Policy. It does not provide direct access to the host OS, victim files, email, or non-web credentials. Google internal telemetry reportedly shows Background Fetch sees average usage of approximately 17 completed files per user per day on Chrome, which a Chromium developer described as evidence that "nothing awful is happening at scale" — i.e., there is no confirmed mass-exploitation campaign yet. However, the leak now exposes working proof-of-concept code to the entire offensive ecosystem.

Status. Unpatched at time of writing (2026-05-21). Google has publicly acknowledged the exposure and stated it is working on a fix; emergency Chromium Stable/Dev channel updates are expected imminently. No CVE has yet been assigned. Threadlinqs is tracking this as ACTIVE with HIGH severity pending emergency patch issuance and downstream Chromium fork (Edge, Brave, Opera, Vivaldi, Arc) update cadence.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1583.001 Acquire Infrastructure: Domains
- T1583.006 Acquire Infrastructure: Web Services
- T1608.001 Stage Capabilities: Upload Malware
- T1608.004 Stage Capabilities: Drive-by Target
- T1189 Drive-by Compromise
- T1566.002 Phishing: Spearphishing Link
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1204.001 User Execution: Malicious Link
- T1203 Exploitation for Client Execution
- T1176 Software Extensions
- T1546 Event Triggered Execution
- T1564 Hide Artifacts
- T1036 Masquerading
- T1185 Browser Session Hijacking
- T1071.001 Application Layer Protocol: Web Protocols
- T1102 Web Service
- T1090 Proxy
- T1090.002 Proxy: External Proxy
- T1090.003 Proxy: Multi-hop Proxy
- T1573.002 Encrypted Channel: Asymmetric Cryptography
- T1498.001 Network Denial of Service: Direct Network Flood
- T1499.003 Endpoint Denial of Service: Application Exhaustion Flood
- T1496 Resource Hijacking

## Sources

- [Google accidentally exposed details of unfixed Chromium flaw](https://www.bleepingcomputer.com/news/security/google-accidentally-exposed-details-of-unfixed-chromium-flaw/)
- [Google publishes exploit code threatening millions of Chromium users](https://arstechnica.com/security/2026/05/google-publishes-exploit-code-threatening-millions-of-chromium-users/)
- [Lyra Rebane — Mastodon disclosure thread on Chromium Background Fetch botnet bug](https://chaos.social/@lyra)
- [Chromium Issue Tracker — original report (access restricted; previously public 2026-05-20)](https://issues.chromium.org/issues)
- [W3C — Background Fetch API specification](https://wicg.github.io/background-fetch/)
- [MDN — Background Fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Background_Fetch_API)
- [MDN — Service Worker API](https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API)
- [Chromium Vulnerability Rewards Program (VRP)](https://g.co/chrome/vrp)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0552