Critical Chrome flaw could secretly turn your phone into a Botnet

The problem was reported back in 2022

The issue was discovered almost three years ago by the independent security researcher Lyra Rebane. They reported the vulnerability to Google in late 2022, but years later it remains unpatched.

What's even worse is that there's publicly available proof-of-concept exploit code built to demonstrate the vulnerability. Anyone with basic knowledge about IT security can use it to do a ton of bad things.

And the scary part is that you don't have to install an app, or click on a suspicious pop-up, or approve a permission — just opening a website could put you at risk.

There's no fix. Why the delay?

According to Rebane, Google acknowledged the issue and classified it as a “serious vulnerability” internally marked as S1. This is Google's second-highest severity rating.

And yet, 29 months later, the vulnerability remains unpatched. What gives? Rebane thinks that this bug falls into an awkward grey area — it's not too dangerous as it doesn't reveal or steal passwords, files, or credit card data, but it's not trivial either.

What can actually be done?

As of this writing, there's no official fix, nor a timeframe for when we can expect one. Google hasn't said anything concrete, and the nature of the vulnerability is such that you might not know if you're affected.

In some cases you might briefly get a downloads-related pop-up without any actual file appearing, but this happens only once, and many people would probably dismiss it without second thought.

The best approach for the moment is to avoid sketchy websites and refrain from initiating downloads. We'll continue to monitor the situation and report back with further developments.