The “Brash” Attack Explained
The flaw, which Pino has dubbed “Brash,” targets Blink, the rendering engine responsible for displaying web pages in Chromium browsers. By repeatedly sending requests to Blink through the “document.title” property of a web page, an attacker can overload the system.
According to Pino’s findings shared on GitHub, Blink processes every change to document.title synchronously and without rate limiting, meaning it handles each update one by one on the main thread. This lack of restriction creates a performance bottleneck that can be abused. “The result is heavy CPU usage, sluggish performance, and the potential for the entire browser session to freeze or crash,” Pino wrote.
Demonstration and Impact
To illustrate the vulnerability, Pino developed a proof-of-concept website that triggers the attack. During tests, the page successfully crashed Chrome on both desktop and Android devices. Other Chromium-based browsers - including Brave, Opera, and ChatGPT’s Atlas - were also affected. In contrast, browsers that don’t use Chromium, such as Mozilla Firefox and Apple Safari, are not vulnerable.
How It Works
Pino’s proof of concept floods Blink’s API with roughly 24 million updates per second, causing the browser to collapse under the load. While the exploit does not compromise user data or passwords, it can still disrupt browsing sessions and slow down the entire system.
Response and Fix
When asked why a patch has not yet been issued, Pino told The Register that he decided to publicly disclose the flaw after his initial private report two months earlier went unanswered. He hopes the exposure will prompt action to protect users. Google has since acknowledged the report and is reportedly investigating a fix - likely involving rate-limiting measures to prevent such overloads in the future.
This incident serves as a reminder that even widely trusted open-source platforms can harbor vulnerabilities - and that timely collaboration between researchers and developers is crucial to keeping the web safe.
Newer Articles
- Elon Musk Envisions Starlink Satellites as Future Space-Based Data Centers
- Hidden Factors No One Considers When Choosing the Best Brokers for Synthetic Indices
- Why Using a VPN at Home Still Matters: Protect Your Privacy and More
