Critical Blink Vulnerability Lets Attackers Crash Chromium Browsers in Seconds

Security researchers have disclosed a critical Blink vulnerability, dubbed Brash, that exposes more than 3 billion users of Chromium-based browsers to denial-of-service attacks. The flaw enables attackers to crash Chrome, Edge, Brave, Opera and others within 15 to 60 seconds via a simple code injection, by exploiting the absence of rate limiting on the document.title API.

The attack works by pre-loading 100 unique hexadecimal strings and then pushing about 24 million document.title updates per second in bursts, saturating the browser’s main thread and rendering the tab unresponsive within seconds. In testing across 11 major browsers, all Chromium-based browsers were found vulnerable, with Chrome crashing in 15–30 seconds, Edge in 15–25 seconds, and Opera around 60 seconds; Firefox and Safari remain immune due to their different rendering engines, as do iOS browsers thanks to WebKit.

The affected Chrome versions are 143.0.7483.0 and earlier, and researchers are pursuing patches to implement proper rate limiting on DOM operations; the findings were reported on Github according to Github. The vulnerability raises concerns for critical infrastructure and day-to-day usability, with potential impacts across desktops, Android devices and embedded systems.