Critical Chromium Browser Vulnerability: DoS Attack via document.title API Exploitation
By
croes
If you only eat one bagel today, this is the bagel.
Summary
The article details 'Brash,' a critical vulnerability in Chromium-based browsers that allows denial-of-service attacks by exploiting the document.title API. The flaw enables attackers to inject millions of DOM mutations per second, saturating the main thread and causing browser collapse within 15-60 seconds. The vulnerability affects Blink rendering engine and has significant security implications for Chromium-based browsers.
Key quotes
· 4 pulledBrash is a critical vulnerability in Blink, the rendering engine that powers Google's Chromium-based browsers.
It allows any Chromium browser to collapse in 15-60 seconds by exploiting an architectural flaw in how certain DOM operations are managed.
The attack vector originates from the complete absence of rate limiting on document.title API updates.
This allows injecting millions of DOM mutations per second, and during this injection attempt, it saturates the main thread, disrupting the event loop and causing the interface to collapse.
You might also wanna read
Critical Remote Code Execution Vulnerability Discovered in Widely Used protobuf.js Library
A critical remote code execution vulnerability has been discovered in protobuf.js, a widely used JavaScript implementation of Google's Proto
bleepingcomputer.com·1mo ago
Security Vulnerability in iTerm2: 'cat readme.txt' Command Can Enable Arbitrary Code Execution
The article reveals a security vulnerability in iTerm2 where the seemingly harmless command 'cat readme.txt' can be exploited for arbitrary
blog.calif.io·1mo ago
Windows Defender Vulnerability Allows Malicious File Persistence Through Cloud Tag Detection
The article describes a GitHub repository called 'RedSun' that documents a Windows Defender vulnerability. The vulnerability involves Window
github.com·1mo ago
PHP 8 Sandbox Escape Exploit: Use-After-Free Vulnerability Bypasses disable_functions
This article describes a PHP 8 sandbox escape proof-of-concept (PoC) that exploits a use-after-free vulnerability to bypass disable_function
github.com·2mo ago
Roundcube Webmail Vulnerability Allows Email Tracking Despite Image Blocking
Roundcube Webmail versions before 1.5.13 and 1.6.13 contain a security vulnerability (CVE-2026-25916) that allows attackers to bypass remote
nullcathedral.com·3mo ago
Critical RCE Vulnerability in React Server Components Affects React 19.x and Next.js 15.x/16.x
A critical security vulnerability (CVE-2025-5518) affects React packages versions 19.0.0-19.2.0 and Next.js 15.x/16.x using App Router, allo
github.com·5mo ago