Cybersecurity experts have revealed a technique that allows access to Chrome DevTools Protocol (CDP) within running Google Chrome or Microsoft Edge processes on Windows. Starting with version 136, Google altered Chrome's remote debugging feature after noticing an uptick in attackers exploiting it to steal cookies following the rollout of App-Bound Encryption (ABE) in 2018. Identifies the loaded chrome.dll or msedge.dll modules.
The screencast mode leaves cookies, browser storage, enterprise authentication state, WebAuthn behavior, extensions, and browser-specific JavaScript behavior inside the Chrome or Edge instance running on the compromised system. Google's Device Bound Session Credentials (DBSC), introduced with Chrome 146 for Windows users, bind session refresh to a hardware-backed key, designed to prevent stolen cookies from being refreshed on another device.
Detection and Version Limits Microsoft's Sysmon documentation identifies Event ID 8 as CreateRemoteThread, which records when a process creates a thread in another process, and Event ID 10 as ProcessAccess, which records when one process opens another. Later browser releases documented by Google and Microsoft include:
- Firefox 65.0.2
- Opera 49.0.2787.52
- Brave 3.1.16
- Vivaldi 2.1.63
- Edge Chromium 147.0.7727.102
- Chrome 147.0.7727.102 Chrome: The repository shows 147.0.7727.102 as tested. Jamf Threat Labs reported the component supports keyboard, mouse, scrolling, navigation, and tab management through CDP, exporting cookies in plaintext during analysis by SpecterOps' Windows research.
