Public exploit published for unpatched vulnerability in Chrome

On October 28, 2025, security researcher Jose Pino published a proof-of-concept (POC) for a vulnerability in Chromium’s Blink rendering engine. The flaw, named Brash, affects desktop and mobile platforms running Microsoft Windows, Apple macOS, and Linux, exposing them to browser crashes triggered by JavaScript (JS) abuse. Impacted browsers include:

• Google Chrome
• Microsoft Edge
• Brave
• Opera
• Other applications based on Chromium versions up to 143.0.7483.0

The exploit has been validated by multiple sources and confirmed to work across several Chromium-based browsers. The POC demonstrates a denial-of-service (DoS) attack in which a malicious webpage uses JS to overwhelm the browser’s internal processes, causing it to freeze, become unresponsive, or crash.

The vulnerability resides in the `document.title` application programming interface (API), which controls the text displayed in a browser tab. By rapidly updating the tab title millions of times per second, the JS code saturates the browser’s main thread, which is the component responsible for rendering and handling user interactions.

This overload prevents the browser from executing other tasks, and causes it to crash or freeze within seconds. No user interaction is required beyond visiting the malicious page, making it suitable for drive-by DoS scenarios.

Although the vulnerability has been publicly disclosed, there is no confirmed evidence of exploitation in the wild. As of October 30, 2025, the flaw remains unpatched, and no workaround has been issued by Google or other Chromium maintainers. At this time, no Common Vulnerabilities and Exposures identifier has been assigned either.

Analyst insight

Unlike memory corruption or sandbox escape vulnerabilities, Brash targets performance limitations in the browser’s architecture, making it easy to execute and difficult to mitigate without a formal fix.

The flaw can be used to crash browsers during critical operations, disrupt headless browser automation, and interfere with real-time systems that rely on Chromium. In a worst-case scenario, it could be used for coordinated attacks on browser-based infrastructure across enterprise environments. The vulnerability does not allow remote code execution or data exfiltration, but its denial-of-service potential is likely high.

Mitigation options are limited until a patch becomes available. Administrators may consider disabling JS in untrusted contexts or using non-Chromium browsers for critical workflows. Web application firewalls (WEF) may block excessive `document.title` updates, though effectiveness may vary since these firewalls operate at the network or application layer rather than within the browser itself. Monitoring for browser crashes and central processing unit spikes may help detect exploitation attempts.

Until a patch is released, isolating critical systems from untrusted web content is recommended to reduce exposure. Reviewing browser dependencies in operational environments and segmenting high-value systems from general web access are practical steps to limit disruption.

Stay on top of emerging threats like this.

Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities. 

Sign up