back in 2022 i found a bug that would let me, with no user interaction, turn any chromium-based browser into a permanent js botnet member
in edge, you wouldn't even notice anything out-of-place, and would stay connected to the c2 even after closing the browser
today, almost 4 years later, the bug is finally public:
https://issues.chromium.org/issues/40062121
even worse, edge no longer even makes the download menu pop up, so it's completely silent js rce that keeps running even after you close the browser !!
all from just visiting a single website once !!
@rebane2001 @cR0w Didn't try, but in theory, full (Manifest v2) uBO should be able to inject a CSP policy that sets worker-src 'none';
https://github.com/gorhill/uBlock/wiki/Static-filter-syntax#csp
Probably something like
||$csp=worker-src 'none'
to disable service workers everywhere?
@rebane2001 @cR0w (I assume using it like that might break extensions that use service workers? Can an extension inject CSP headers into a different extension? No idea.)
Anyways, turns out someone wrote up exactly that at some point: https://bonina.eu/web/disable-service-workers-chromium-browsers/
Rebane
cR0w
Alexander Bochmann