A critical security flaw known as Brash has been uncovered in nearly all Chromium-based browsers, potentially affecting billions of users worldwide. Security researcher Jose Pino discovered the vulnerability, which impacts any Chromium build up to version 143.0.7483.0, including popular browsers like Chrome, Edge, Opera, Brave, Vivaldi, and Arc. The flaw originates in Blink, Chromium’s rendering engine, and can cause browsers to freeze or crash within seconds by exploiting how certain DOM operations are handled. Pino’s findings suggest that Brash can bring browsers to a halt in as little as 15 to 60 seconds, effectively leading to a system-level denial of service.
According to Pino, the vulnerability arises from a lack of rate limiting on document.title API updates, allowing attackers to flood the browser with millions of DOM mutations per second. This overwhelms the main thread and disrupts the event loop, consuming heavy CPU resources and degrading system performance. In severe cases, this attack can slow or even freeze the entire operating system, particularly when targeting desktops or mobile devices where Chrome and Chromium dominate. The scope of exposure is enormous—Pino estimates over 3 billion users could be vulnerable across multiple platforms, including Android and embedded systems.
Tests have confirmed the issue, with browsers like Chrome freezing entirely when visiting malicious or test sites such as brash.run, while Firefox and Safari remain unaffected. In most cases, users can simply close the browser to recover, but the potential for exploitation in real-world scenarios is significant. Pino has published technical details of Brash on GitHub, offering transparency while awaiting an official fix. Google has acknowledged the vulnerability and is currently investigating, though a patch has not yet been released. Until then, users are advised to exercise caution and consider temporary use of non-Chromium browsers for critical tasks.
