Chrome Dev Tools Technique Enables Authenticated Session Hijacking in Live Windows Browsers

Summary: SpecterOps detailed a post-exploitation technique, CDP-Enable-BOF, that activates the Chrome DevTools Protocol inside an already-running chrome.exe or msedge.exe process on Windows, exposing cookies, saved data, and authenticated sessions without exploiting a browser vulnerability. The x64 Beacon Object File requires prior code execution on the host but not administrator access, and SpecterOps said it works on Chrome 151 and Edge 151 with the signatures already in the repository.
What you should know: Google said that since App-Bound Encryption was enabled it has seen an increase in attackers using Chrome Remote Debugging to extract cookies, and this technique runs inside the victim's own authenticated browser, which SpecterOps said can sidestep protections meant to stop off-device replay. The defenders' signal is narrow: Sysmon Event IDs 8 and 10 for process injection into chrome.exe and msedge.exe.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026