Google’s accidental exposure of details about an unfixed Chromium vulnerability is a serious reminder that browser security issues can become large-scale risks very quickly. According to the report, the flaw allows JavaScript to keep running in the background even after the browser is closed, through abuse of a Service Worker-style mechanism. That could enable remote code execution in the browser context simply by getting a user to visit a malicious page once. Because apparently closing the browser now may only close your illusion of control.

The issue is especially concerning because it impacts Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Vivaldi, and Arc. Potential abuse scenarios include using compromised browsers for DDoS activity, proxying malicious traffic, and redirecting traffic to attacker-controlled or target sites. The report also notes that the details became public because the issue was marked as fixed even though it had not actually been fully resolved. 

At the same time, it is important to be precise: the researcher clarified that the bug does not bypass browser security boundaries and does not directly give attackers access to a victim’s emails, files, or operating system. Still, a persistent background execution path in a browser is serious enough, especially at Chromium’s scale. One browser bug can affect millions of users across multiple products, because software monoculture remains the gift that keeps giving attackers bulk discounts. 

Organizations should ensure browsers are updated as soon as emergency fixes are released, monitor browser versions across managed endpoints, restrict risky browser extensions, use DNS and web filtering to block malicious domains, and watch for unusual outbound traffic patterns from endpoints. Security teams should also remind users that simply closing a browser is not always enough if the underlying browser process or service worker behavior is abused. 

The larger lesson is that browsers are now full application platforms, not simple website viewers. They execute code, cache data, run background tasks, sync identities, and connect deeply into enterprise workflows. That makes browser security, update enforcement, web filtering, endpoint monitoring, and safe browsing controls essential parts of enterprise defense, not optional desktop hygiene.

Google has accidentally leaked details about an unfixed issue in Chromium that keeps JavaScript running in the background even when the browser is closed, allowing remote code execution on the device. [...]

Source: Google accidentally exposed details of unfixed Chromium flaw via Bleeping Computer — published 21 May 2026.