Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers
SpecterOps released CDP-Enable-BOF, a Beacon Object File that enables Chrome DevTools Protocol in live Chrome or Edge processes on Windows for session hijacking.
SpecterOps released CDP-Enable-BOF, an x64 Beacon Object File that activates Chrome DevTools Protocol inside running chrome.exe or msedge.exe processes on Windows, exposing cookies, history, saved passwords, and authenticated sessions without administrator rights. It calls Chromium's StartRemoteDebuggingServer on the browser UI thread to stay reliable under CFG, TLS, and CET, and was tested on Chrome 147 and Edge 147. The technique builds on work by DeathFlamingo and Cedric Van Bockhaven; Google had hardened remote debugging in Chrome 136 after attackers used it to steal cookies post-App-Bound Encryption. Defenders can watch Sysmon Event IDs 8 and 10 for injection into browser processes.
- CDP-Enable-BOF activates the debugging server inside running chrome.exe or msedge.exe, exposing cookies, history, passwords, and authenticated sessions.
- Calls Chromium's StartRemoteDebuggingServer on the browser UI thread for reliability under CFG, TLS, and CET.
- Requires existing code execution, x64, and no administrator rights; tested on Chrome 147 and Edge 147.
- Google hardened remote debugging in Chrome 136; Device Bound Session Credentials in Chrome 146 limit off-device cookie replay.
- Detectable via Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) on chrome.exe and msedge.exe.
- Vendors
- SpecterOpsGoogleMicrosoft
From the original article
5 min read at thehackernews.com
Cybersecurity researchers have detailed a post-exploitation technique that enables the Chrome DevTools Protocol (CDP) inside a running Google Chrome or Microsoft Edge process on Windows, allowing an operator to access cookies, saved data, and authenticated browser sessions.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.