Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers

Cybersecurity researchers at SpecterOps have detailed a post-exploitation technique that enables the Chrome DevTools Protocol (CDP) inside a running Google Chrome or Microsoft Edge process on Windows, allowing an operator to access cookies, saved data, and authenticated browser sessions. The technique assumes that an operator already has code execution on the Windows host and does not involve exploiting a Chrome or Edge security vulnerability. The requirement for prior code execution and sufficient access to manipulate the target process places the technique in a narrower post-compromise scenario than a remotely exploitable browser flaw.

SpecterOps said defenders can look for signs of process injection targeting chrome.exe and msedge.exe using Sysmon Event IDs 8 and 10. Google changed Chrome’s remote debugging behavior beginning with Chrome 136 after observing an increase in attackers using Chrome Remote Debugging to extract cookies following the introduction of App-Bound Encryption (ABE). Chrome 136 ignores the –remote-debugging-port and –remote-debugging-pipe switches when they target the default Chrome data directory unless they are accompanied by a non-standard –user-data-dir.

According to SpecterOps, the CDP-Enable-BOF takes a different path by activating the debugging server from inside an existing chrome.exe or msedge.exe process. The x64 Beacon Object File (BOF) then exposes the browser’s existing context over a requested CDP port. The BOF builds on earlier work by DeathFlamingo and Cedric Van Bockhaven. At a high level, CDP-Enable-BOF performs the following steps: finds the requested live Chrome or Edge process and its top-level window, locates the loaded chrome.dll or msedge.dll module, resolves internal Chromium symbols using masked byte signatures, allocates remote memory for two small stubs and a context block, temporarily installs a remote window procedure, executes the final call on the browser user interface thread, and calls Chromium’s internal StartRemoteDebuggingServer function on the requested port.

Once the endpoint is available, SpecterOps’ CDP-Toolkit can interact with the browser directly or automate its internal WebUI surfaces. The main post-exploitation workflows include cookie collection, browser data collection, saved-password recovery, and browser takeover. The screencast mode leaves cookies, browser storage, enterprise authentication state, WebAuthn behavior, extensions, and browser-specific JavaScript behavior inside the Chrome or Edge instance running on the compromised system. The proxy mode makes upstream requests through browser targets carrying the victim’s authenticated state on the compromised endpoint.

Google’s Device Bound Session Credentials (DBSC), which became available to Windows users with Chrome 146, bind session refresh to a hardware-backed key and are designed to prevent stolen cookies from being refreshed on another device. SpecterOps does not describe extracting that private key. The firm said operating through the authenticated browser context can sidestep protections intended to prevent off-device replay.

Microsoft’s Sysmon documentation identifies Event ID 8 as CreateRemoteThread and Event ID 10 as ProcessAccess. The Hacker News confirmed via GitHub on August 14 that the public BOF still lists Chrome 147.0.7727.102 and Edge 147.0.3912.98 as its tested versions and describes the signatures as version-specific. The repository provides scripts for deriving new signatures when browser updates cause symbol resolution to fail, but it does not establish that its bundled signatures work unchanged against later browser releases.

The development comes a day after AmnesiaStealer was disclosed, targeting macOS users with a stream_module that grants an operator hidden, interactive control over a Chromium browser. Jamf Threat Labs said the component supports keyboard, mouse, scrolling, navigation, and tab management through CDP, and that it exported cookies in plaintext during its analysis.