Google Chrome Logo *Original image source: [blogger.googleusercontent.com](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqxmoJtQxCw_JRBCIc5vQ8KP7fDvEliYGDzRe4RRTwH_vydH3_bliXj-rfs_e5j3YD6EPrvVKtSlI_IUIA5EoxajlFgyLPhLtjiYZjwotvmIHvLuvf_bIhfUuGJ-Sgxx0Wjhl7UigBQko3hYNb44Z4PT6fRSXFEVdPZIzMjLe7uge8CWthwqzErdqpheA/s1600/chrome.jpg



Cybersecurityresearchershavedetailedanewpost-exploitationtechniquethatleveragestheChromeDevToolsProtocol(CDP)* from within a running Google Chrome or Microsoft Edge process on Windows. This method allows attackers, who have already achieved code execution on the target host, to access sensitive browser data like cookies, saved passwords, and authenticated browser sessions.



Understanding the CDP Post-Exploitation Technique

This technique is not an exploit for a browser vulnerability but rather a method for attackers to gain deeper control and extract data once initial access is established. It addresses a post-compromise scenario, offering a powerful way to escalate privileges within the compromised system’s browser context.



Google previously noted an increase in attackers using Chrome Remote Debugging for cookie extraction following the introduction of App-Bound Encryption (ABE). While Chrome 136 introduced changes to make remote debugging harder for malicious actors by ignoring standard debugging switches unless a non-standard user data directory is used, this new technique bypasses such protections.



SpecterOps’ CDP-Enable-BOF

SpecterOps has developed a Beacon Object File (BOF) called CDP-Enable-BOF (x64) that activates the debugging server from inside an existing chrome.exe or msedge.exe process. This internal activation then exposes the browser’s current context over a requested CDP port.



The technique builds on earlier research into injecting CDP into running browsers. At a high level, CDP-Enable-BOF performs the following steps:

  • Identifies the target live Chrome or Edge process and its main window.
  • Locates the loaded chrome.dll or msedge.dll module.
  • Resolves internal Chromium symbols using byte signatures.
  • Allocates remote memory for necessary stubs and a context block.
  • Temporarily installs a remote window procedure.
  • Executes the final call on the browser’s user interface thread to ensure reliability against security features like CFG, TLS, and CET.
  • Invokes Chromium’s internal StartRemoteDebuggingServer function on a specified port.

This BOF requires a running browser process and is limited to x64 systems. The public repository currently doesn’t specify if administrator rights are universally required.



Post-Exploitation Workflows with CDP-Toolkit

Once the CDP endpoint is available, SpecterOps’ CDP-Toolkit can interact with the browser directly, enabling several powerful post-exploitation capabilities:

  • Cookie Collection: Utilizes Storage.getCookies to retrieve browser cookie state without directly accessing the cookie database on disk.
  • Browser Data Collection: Gathers sensitive information such as browsing history, bookmarks, installed extensions, screenshots, and metadata for saved passwords directly via CDP and browser-rendered pages.
  • Saved-Password Recovery: Exploits Chromium’s autofill functionality against matching origins and extracts username and password field values through CDP.
  • Browser Takeover: Creates an offscreen or background browser target for interactive screencasting or to proxy HTTP and HTTPS requests through the victim’s authenticated session state. This method preserves cookies, browser storage, enterprise authentication, WebAuthn behavior, extensions, and JavaScript behavior within the compromised browser instance.
  • Bypassing DBSC: By operating within the authenticated browser context, this technique can potentially circumvent Google’s Device Bound Session Credentials (DBSC) which aim to prevent stolen cookies from being refreshed on other devices, as it doesn’t involve extracting the hardware-backed private key.

Detection and Version Compatibility

Defenders can look for signs of process injection targeting chrome.exe and msedge.exe using Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess). While Event ID 8 often indicates code injection, Event ID 10 may require careful filtering due to high logging volume.



The technique’s signatures are version-specific. As of August 14, the public BOF lists Chrome 147.0.7727.102 and Edge 147.0.3912.98 as tested versions. While later browser releases exist, the repository provides scripts to derive new signatures when browser updates cause symbol resolution to fail.



This development follows the recent disclosure of AmnesiaStealer, which targets macOS users with a similar stream_module to control Chromium browsers via CDP, highlighting the increasing use of these protocols by attackers.



Conclusión

The ability to activate and leverage the Chrome DevTools Protocol post-compromise represents a significant threat for organizations. This technique allows attackers to bypass certain browser security mechanisms, such as App-Bound Encryption and potentially Device Bound Session Credentials, by operating directly within the victim’s authenticated browser context. It underscores the importance of robust endpoint detection and response (EDR) capabilities, particularly focusing on process injection detection, to identify and mitigate such sophisticated post-exploitation activities. Organizations should prioritize threat hunting for anomalous process behavior related to browser executables to protect sensitive user data and authenticated sessions.



Referencias

Original source: View original article

  • SpecterOps research on CDP-Enable-BOF
  • Google’s observations on Chrome Remote Debugging abuse (March 2025 post)
  • Work by DeathFlamingo on injecting CDP into Edge (December 2025)
  • Cedric Van Bockhaven’s “Modern Session Hijacking by Living off the DevTools Protocol”
  • Microsoft Sysmon documentation (Event IDs 8 and 10)
  • Jamf Threat Labs’ analysis of AmnesiaStealer (macOS)