back in 2022 i found a bug that would let me, with no user interaction, turn any chromium-based browser into a permanent js botnet member
in edge, you wouldn't even notice anything out-of-place, and would stay connected to the c2 even after closing the browser
today, almost 4 years later, the bug is finally public:
https://issues.chromium.org/issues/40062121
OH NO I JUST REALIZED THIS IS NOT ACTUALLY PROPERLY FIXED AND STILL WORKS 💀💀
even worse, edge no longer even makes the download menu pop up, so it's completely silent js rce that keeps running even after you close the browser !!
all from just visiting a single website once !!
issue set to private again, hopefully it'll get fixed properly this time :p
Took over 3 years to fix!?
@rebane2001 Damn you get some really long running bugs don't you?
Out of curiosity whats the longest you've had to wait for one like that?
Also got to love the org that famously gives people 90 days to fix things taking 1460 days :P
May 20, 2026, 11:53 AM@rebane2001 Am I missing something or is this still very much exploitable?
@atjn i haven't tried lmao, i hope not
@atjn oh no..
@rebane2001 @atjn I feel this oh no in my soul
May 20, 2026, 12:07 PM@rebane2001 ah yes. Background fetch. Such a good concept 👀
@rebane2001
oooof, thats not good😬
3,5 years...
sent from my firefox
i second this, sent from my epiphany
May 20, 2026, 7:26 PM@utf_7 @henry_null @rebane2001 fellow rare #GNOME Web user found in the wild
@rebane2001 oops, happy 0day 4year to those who celebrate
May 20, 2026, 12:18 PM@rebane2001@infosec.exchange oh :overjoyed:
May 20, 2026, 12:32 PM@rebane2001 I guess it's a good thing I asked 😂
@rebane2001 So much for Edge having “the added trust of Microsoft”.
@rebane2001 Is this what they call a 1259 day?
@henry_null @rebane2001 Cue Microsoft issuing a press release accusing Rebane of "violating coordinated vulnerability best practices." They've barely had time to react, after all...
@EdCates @rebane2001 I mean its them who made it public first I guess🤷 https://issues.chromium.org/issues/40062121#comment56
@EdCates
Then demanding that @GossiTheDog remove the account from all of the Fediverse
https://cyberplace.social/@GossiTheDog/115174005290146637
@henry_null @rebane2001
May 20, 2026, 1:59 PM
@rebane2001 well that's not good...
@rebane2001 BeEF module ftw! 🎉
@rebane2001 Nice find! I should have woken up earlier to see the details. 😅
@rebane2001 fucking embarrassing
@rebane2001 Well, too late, it has already been archived :x
@SamantazFox out of curiosity, where? the archive.org captures don't load for me
edit: ty :)
May 20, 2026, 4:06 PM@rebane2001 @SamantazFox It's on archive.today/.is/.ph. Only go there with a content blocker, you're DDoSing a small blog otherwise: https://gyrovague.com/2026/02/01/archive-today-is-directing-a-ddos-attack-against-my-blog/
May 20, 2026, 5:25 PM@Lenni @rebane2001 @SamantazFox
Archive.today is rolling out Google's QR reCaptcha as well paired with altering snapshots, seems like potential vector for a bad time.
@milagemayvary @Lenni @rebane2001 @SamantazFox
archive.org has already scrubbed archives of incriminating words by sex offenders like Andrew Tate, Vitalik Butterin, and a DOGE staffer, so really, who can I wing for?
May 20, 2026, 10:55 PM@PuppyFromLosAndes @Lenni @rebane2001 @SamantazFox
I assume we're speaking of Kiwi Farms?
Is it scrubbed from archive.org, or is it present for research purposes?
I would assume they have kept the data, I think they would respond to a subpoena with the snapshot.
After about 10 minutes of searching, I'm not entirely sure if archive.today has been used as admissable evidence in a court room let alone successfully.
IANAL, I feel like this is a legal quagmire & legally safer to exclude?
May 20, 2026, 11:13 PM@Lenni @rebane2001 @SamantazFox
I do genuinely wonder why the blog's author is so interested in doxing the archive.is's operator?
The response of getting DDoS:ed by the operator does also make it look like they hit close.
@rebane2001 really cool work. Didn't realize this sort of bug class even existed. Hope they up the bounty; this seems worth more than $1000
@rebane2001 could you test vivaldi? :D
@Viss @rebane2001 it's mentioned in an Ars Technica article that Vivaldi is also vulnerable.
>Other browsers Rebans confirmed as vulnerable include Brave, Opera, Vivaldi, and Arc.
@seanm @rebane2001 spectacular
@Viss @rebane2001 Vivaldi is Chromium, why do people think Chromium issues don't apply to it?
May 20, 2026, 7:03 PM@rebane2001 So they have fixed the bug. The one with the download menu popping up during eval.
@rebane2001 fucking spectacular.
@rebane2001 if you disable running in background in edge does it still run if closed?
@rebane2001 🤦♂️
May 20, 2026, 2:38 PM@rebane2001 peak google efficiency
@rebane2001 Oops.
@rebane2001 @zhenech Emotional (and security) rollercoaster, full steam ahead…
Pfffrrrrsssshhh.
Even the "most secure web browser" ends up being just as incompetent as the rest.
May 20, 2026, 10:29 PM@rebane2001 lol
@rebane2001 I am once again vindicated for having service workers blocked with uBlock
@rebane2001 well that doesn't look too good for chromium based browser
@rebane2001 Hold a really cool presentation about it? There's a conference in Stockholm (SE) in September who pays their speakers, CFP is open: https://event.sec-t.org/sec-t-2026/cfp
@rebane2001 would the service worker process stay around even without the main browser process with edge?
@9pfs no, but the main process stays running even after closing all visible windows
May 20, 2026, 12:33 PM@rebane2001 hmm I can't see that bug report, it just promts me to sign in
@4censord works for me on a fresh session, might have to wait for it to load?
May 20, 2026, 12:41 PM@rebane2001 hmm, nothing is loading for me, I've waited around 30s
There is also no loading indicator.
I'm using a similar browser as well, its also Firefox klar
May 20, 2026, 12:43 PM@4censord@unfug.social @rebane2001@infosec.exchange Klar is a Germany-specific thing, it might have different rules
May 20, 2026, 12:47 PM@rebane2001 @natty they are very similar afaik, mostly branding because Germany has another established thing called "focus"
But I'll retry in fennec in a sec