“The assault vector originates from the entire absence of charge limiting on doc.title API updates,” Pino wrote within the technical doc. “This permits injecting thousands and thousands of DOM mutations per second, and through this injection try, it saturates the primary thread, disrupting the occasion loop and inflicting the interface to break down.”
The exploit impacts Chromium variations 143.0.7483.0 and earlier. Pino examined 11 browsers throughout macOS, Home windows, Linux, and Android. 9 proved susceptible: Chrome, Edge, Vivaldi, Arc, Dia, Opera, Perplexity Comet, ChatGPT Atlas, and Courageous.
Firefox and Safari emerged unscathed. Each use completely different rendering engines — Gecko and WebKit, respectively — that don’t share Blink’s architectural flaw. All iOS browsers additionally escaped as a result of Apple requires them to make use of WebKit, Pino added within the doc.
