Brush exploit can cause any Chromium browser to collapse in 15-60 seconds

A security researcher has revealed a flaw in Chromium’s Blink rendering engine, dubbed Brash, which can crash many Chromium-based browsers within 15-60 seconds via a single malicious URL. According to SecurityAffairs, Brash exploits the lack of rate limiting in the document.title API to flood the main thread with millions of DOM updates per second, causing severe CPU spikes and freezes across desktop, Android and embedded devices.

The attack unfolds in three phases, beginning with preloading 100 unique 512-character hex strings, followed by a burst injector delivering rapid triple-updates and then continuous injections that saturate the UI thread, leading to a collapse or forced termination. The researchers tested 11 major browsers on macOS, Windows and Linux; Chrome, Edge, Vivaldi, Arc Browser, Dia, Perplexity Comet, ChatGPT Atlas and Brave show rapid crashes within 15-125 seconds, while Opera is noted as around 60 seconds and others vary.

The piece highlights that Brash can be weaponized to trigger at precise times, with potential widespread global impact given the hundreds of millions of Chromium users.