A Three-Year-Old Chromium Bug Can Turn Your Browser Into a Bot — And It's Still Not Fixed

The bug report sat in Google's tracker for over three years. Then, briefly, it was public. Long enough for the internet to archive it.

The vulnerability at the center of this story was first reported in December 2022 by independent researcher Lyra Rebane. It lives inside Chromium, the open-source engine that powers Google Chrome, Microsoft Edge, and Opera. The flaw abuses the Background Fetch API and the Service Worker feature to keep a browser process alive indefinitely — even after the user has closed every tab and walked away from their machine.

Service workers are, by design, meant to have a limited lifespan. Google said as much when it introduced the Background Fetch API in 2018, writing that the approach was specifically built to prevent a website from "mining bitcoin in the background." Rebane's proof-of-concept exploit shows that promise did not hold.

Day one, December 2022. Rebane files her report. In stable Chrome at the time, a background download at least appeared in the download bar, a faint tell. But in Chrome Canary's new UI, it looked like a glitch: a download stuck at 0 bytes, no source shown. On Microsoft Edge, the dropdown appeared with nothing inside it. In the most recent Chromium builds, the download is completely invisible and persists after the browser closes.

January 2023. Google's engineers address the UI side of the problem. The cosmetic tells get patched. But the deeper mechanism — the ability to cycle between creating and aborting background fetches every 20 seconds, resetting the service worker's clock each time so it never expires — that part remains. Fixing it would require amending the API specification itself to impose a hard time limit on service worker lifespans, a change that never came.

This week. The bug tracker entry briefly went public, then private again after Rebane posted on Mastodon that the core issue still isn't properly resolved. The archive had already done its work. Copies circulate.

So what can a persistent service worker actually do? The list is constrained but uncomfortable. A compromised website can track users across sessions (service workers have access to browser open timestamps, IP addresses, and User-Agent strings). It can fetch and execute remote JavaScript payloads, opening a side door for side-channel attacks or WebAssembly-based crypto miners. And it can issue requests to third-party targets — meaning a popular site sitting on this flaw could conscript thousands of visiting browsers into a distributed denial-of-service swarm without any of those users knowing.

"If the background fetch is created and aborted fast enough, it won't show up in the browser UI at all, but will still keep the Service Worker active," Rebane wrote in her report.

The specification hasn't changed. No patch addresses the persistence mechanism. Chromium remains the substrate for the majority of desktop browsing globally, and the question of who has been quietly using this technique in the three years since Rebane first flagged it is one nobody has answered yet.