Conversation

Notices

1. Embed this notice
   Rebane (rebane2001@infosec.exchange)'s status on Wednesday, 20-May-2026 22:29:46 JST Rebane

   back in 2022 i found a bug that would let me, with no user interaction, turn any chromium-based browser into a permanent js botnet member

   in edge, you wouldn't even notice anything out-of-place, and would stay connected to the c2 even after closing the browser

   today, almost 4 years later, the bug is finally public:
   https://issues.chromium.org/issues/40062121

   • Jesse 🇫🇷 repeated this.
   • Embed this notice
     Rebane (rebane2001@infosec.exchange)'s status on Thursday, 21-May-2026 02:06:53 JST Rebane

     in reply to

     OH NO I JUST REALIZED THIS IS NOT ACTUALLY PROPERLY FIXED AND STILL WORKS 💀💀

     scriptjunkie repeated this.
   • Embed this notice
     Rebane (rebane2001@infosec.exchange)'s status on Thursday, 21-May-2026 05:19:31 JST Rebane

     in reply to

     even worse, edge no longer even makes the download menu pop up, so it's completely silent js rce that keeps running even after you close the browser !!

     all from just visiting a single website once !!