https://www.theregister.com/2025/10/29/ ... /?td=rt-3a
Some quotes from the article:
One tab using 18GB of RAM (remember, Blink doesn't limit resource consumption):The flaw is due to the absence of throttling on document.title updates, so it essentially takes advantage of the fact that Blink doesn't limit resource consumption. ... Any web page could contain the malicious JavaScript code
The exploit in 3 simple steps:The Register tested the code on Edge, and not only did it crash the browser, but it also locked up the Windows-based machine after about 30 seconds, and sucked down 18 GB of RAM into one tab.
I'm assuming Pale Moon would not be susceptible to such an attack. Neither Firefox nor Safari were. But all chromium-based browsers are open to the attack, and the bad news for them is that each chromium-based browser will likely require an independent fix. They probably can't just sit back and wait for Google to figure it out.First, in the preparation phase, the attacker pre-loads into memory 100 unique hexadecimal strings of 512 characters. It's "crucial" not to simply reuse strings because that reduces the attack's effectiveness, Pino explained.
Next, the attack executes in bursts of three consecutive document.title updates. Pino used a default configuration (burst: 8000, interval: 1ms), which means about 24 million updates per second are attempted, thus causing the browser crash.
Then in the third stage, the continuous updates saturate the browser's main thread, thus consuming massive amounts of compute and preventing it from processing other events. Between five and 10 seconds in, the browser's tabs will freeze, between 10 and 15 seconds, it will collapse or show a "page unresponsive" dialog box, and between 15 and 60 seconds into the attack, Chromium-based browsers will require forced termination.
