Critical Vulnerability in Chromium Blink Crashes Chrome and Edge Within Seconds

TL;DR — Don’t Click Random URLs; Apply Temporary Workarounds

• What’s new: “Brash” DoS crashes many Chromium browsers in 15–60s by saturating the UI thread with extreme document.title mutations. 
• Impact: Browser collapse, possible system freeze and high RAM consumption; unsaved tab work can be lost. 
• Scope: Chrome, Edge, Brave, Opera, Vivaldi, Arc, Perplexity Comet, ChatGPT Atlas (tested vulnerable). 
• Status: Public PoC + live demo; outlets report no upstream fix yet. Keep auto-updates ON for a rapid patch when available. 

Background: What “Brash” Exploits

The flaw lives in the **Blink** engine’s handling of document.title updates. There’s **no rate-limit** on title mutations; a page can spam millions of DOM/title changes per second, **saturating the main UI thread** so input/events stop and the browser collapses. Research explains a 3-phase attack (preloading long strings ➜ burst-injection ➜ UI saturation).

Which Browsers Are Affected

Any modern browser that uses **Chromium/Blink** is at risk. Testing and newsroom verification list: **Chrome, Edge, Brave, Opera, Vivaldi, Arc, Dia, Perplexity Comet, ChatGPT Atlas**. **Firefox (Gecko)** and **Safari (WebKit)** — and all iOS browsers (WebKit-based) — are **not affected**. 

Immediate User Workarounds (Safe, Practical)

1. Be click-skeptical: Treat unknown/shortened links as suspect until the patch lands.
2. Use a non-Chromium fallback (temporarily) for critical work — e.g., Firefox/Safari. 
3. Tab killers: If a tab locks up, use OS-level task manager to kill the specific browser process tree quickly to avoid data loss elsewhere.
4. Content filtering: Block known PoC domains in DNS/secure web gateway (e.g., the public demo host noted in reports) until vendors ship throttling fixes. 
5. Keep auto-update ON in Chrome/Edge so the fix applies as soon as it’s released (check About → update). Vendors are investigating per press statements. 

Enterprise Guardrails (SecOps)

• SWG/DNS policy: Block the public PoC host(s) and known mirrors; deploy category rules to throttle access to unclassified/newly-seen domains during the window. 
• EDR response: Create a **browser CPU/RAM spike rule** to prompt/kill a tab’s process when sustained usage is detected after navigation events.
• Vuln comms: Internal bulletin: “Chromium DoS (‘Brash’) — avoid unknown links; use Firefox/Safari for critical workflows until patched.”
• Fallback policy: Offer non-Chromium browser in VDI/jump hosts for work-critical systems.
• Change control: Keep **Chrome/Edge auto-updates enabled** org-wide; monitor vendor advisories for a fix push.

Hunt Ideas & Telemetry

• Proxy/SWG: Sudden navigation to a previously unseen domain followed by **abrupt TCP resets** or **long-running connections** with simultaneous **endpoint CPU spikes**.
• Endpoint metrics: Per-process (chrome.exe/msedge.exe) CPU ≥90% for ≥15s immediately after page load; resident set size surges (reports cite even ~18GB RAM in a single tab during tests). 
• Helpdesk intel: Spikes in “page unresponsive” / forced-quit incidents tied to specific URLs.

CyberDudeBivash Services, Apps & Ecosystem

Services (Hire Us)

• Enterprise Browser Hardening & Secure Web Gateway Policy
• Incident Response: Endpoint Containment & User Comms Kits
• Threat Intel & Rapid Advisory Write-ups for Exec/IT
• Blue-Team Runbooks for DoS/Resource-Starvation Attacks

Our Departments & Pages

• Main Site — Apps & Services
• CyberBivash — Threat Intel & CVEs
• CryptoBivash — Crypto/Blockchain
• CyberDudeBivash News — Headlines
• ThreatWire Newsletter

FAQ

Is this remote code execution?

No. It’s a **denial-of-service** that crashes/freezes the browser by choking the UI thread. Still disruptive: you can lose unsaved work.

Is there a CVE or patch already?

Coverage states no upstream patch yet at time of writing; vendors say they’re looking into it. Keep auto-updates on to receive a fix as soon as it ships.

Are Firefox/Safari really safe here?

Yes, both use different engines (Gecko/WebKit) and tests report immunity to this specific technique. 

Sources

• The Register — “Security hole slams Chromium browsers — no fix yet” (Oct 29, 2025). Details, timelines, impact, vendor responses, tests on Edge, RAM spike. 
• The Hacker News — “New ‘Brash’ Exploit Crashes Chromium Browsers Instantly…” (Oct 30, 2025). Mechanism via document.title; affected browsers; researcher attribution. 
• Jose Pino (GitHub) — jofpin/brash repo with PoC and technical breakdown (affected versions, 3-phase attack).