Cybersecurity researchers have uncovered a post-exploitation method that leverages the Chrome DevTools Protocol (CDP) within active Google Chrome or Microsoft Edge processes on Windows systems. This technique allows attackers to access cookies, saved data, and authenticated browser sessions without exploiting any specific browser vulnerabilities.
The method requires prior code execution on the target Windows host, positioning it as a post-compromise tactic rather than a means of initial intrusion. By injecting code into a running browser process, attackers can activate the debugging server internally, exposing the browser’s current context over a specified CDP port.
Technical Breakdown of the Attack
The attack involves several steps:
- Identifying the active Chrome or Edge process and its main window.
- Locating the loaded browser module (chrome.dll or msedge.dll).
- Resolving internal Chromium symbols using specific byte signatures.
- Allocating remote memory for necessary stubs and context blocks.
- Temporarily installing a remote window procedure.
- Executing a call on the browser’s user interface thread.
- Invoking Chromium’s internal StartRemoteDebuggingServer function on the chosen port.
Once the debugging server is active, tools like SpecterOps’ CDP-Toolkit can interact with the browser to collect cookies, retrieve browsing history, and access other sensitive data.
Defensive Measures and Implications
Defenders can monitor for signs of process injection targeting browser processes using tools like Sysmon, specifically looking at Event IDs 8 and 10. Additionally, Google has implemented changes in Chrome 136 to ignore certain debugging switches when targeting the default data directory, enhancing security against such techniques.
This development underscores the evolving nature of post-exploitation tactics, emphasizing the need for robust endpoint monitoring and proactive security measures to detect and mitigate such sophisticated attacks.
