New "Brash" Exploit Crashes Chromium Browsers Instantly with a Single Malicious URL

A severe vulnerability in Chromium’s Blink rendering engine, codenamed Brash by security researcher Jose Pino, can crash many Chromium-based browsers within seconds, according to The Hacker News. The attack hinges on an architectural flaw in how certain DOM operations are managed, driven by an unmitigated flood of document.title updates that bombard the DOM with mutations.

In practice, Brash preloads 100 unique hexadecimal strings to seed title changes, then bursts of three consecutive document.title updates are executed, injecting roughly 24 million updates per second in default configuration, saturating the UI thread and forcing the browser to become unresponsive. The attack can be timed to run at specific moments, turning Brash into a temporal precision weapon, with the potential to be triggered by a specially crafted URL, as described in the report.

The vulnerability affects Google Chrome and all web browsers based on Chromium, while Mozilla Firefox and Apple Safari remain immune; The Hacker News notes that it is unclear when a fix will appear and has contacted Google for comment. 30 October 2025.