VoidStealer malware steals Chrome master key via debugger trick
In order to get beyond Chrome's Application-Bound Encryption (ABE) and retrieve the master key needed to decrypt private information kept in the browser, an information thief known as VoidStealer employs a novel technique.
The new technique is more covert and uses hardware breakpoints to retrieve the v20_master_key—which is utilized for both encryption and decryption—directly from the browser's memory without the need for code injection or privilege escalation.
This is the first instance of an infostealer seen using such a method in the field, according to a report by Gen Digital, the parent company of the Norton, Avast, AVG, and Avira brands.
In June 2024, Google launched Chrome 127, which included ABE as a new safeguard for cookies and other private browser information. It guar...