App-Bound Encryption in Chrome 148: What Changed and Why Credential Theft Just Got Harder

## Chrome 148's Biggest Security Change

Chrome 148 shipped with App-Bound Encryption (ABE) — a fundamental change to how the browser stores cookies, passwords, and authentication tokens. The change is significant enough that it blocks most infostealer malware from extracting credentials.

## How App-Bound Encryption Works

Previously, Chrome encrypted sensitive data using DPAPI (Windows Data Protection API). DPAPI encrypts with the user's login credential — any process running as that user can decrypt. Infostealers exploited this: run as the logged-in user, call DPAPI, extract everything.

Chrome 148 changes the encryption key to be bound to Chrome's process identity. Only the Chrome process (verified by its digital signature) can decrypt the data. Even malware running as the same user cannot decrypt Chrome's protected storage.

| Before (pre-148) | After (Chrome 148+) |
|-----------------|-------------------|
| DPAPI: any user process can decrypt | App-Bound: only Chrome.exe can decrypt |
| Infostealer: trivial cookie extraction | Infostealer: must inject into Chrome process |
| Attack surface: application layer | Attack surface: process memory (harder) |

## How Bypasses Work

The infostealer community immediately pivoted. Current bypass techniques:
1. **Process injection**: Inject code into Chrome.exe to call decryption from within the trusted process. Harder than DPAPI, requires elevated privileges or user interaction.
2. **DLL hijacking**: Drop a malicious DLL that Chrome loads. More detectable by EDR.
3. **CDP (Chrome DevTools Protocol)**: Connect to Chrome's debugging port (--remote-debugging-port) and extract cookies via the DevTools API. Chrome 148+ now limits CDP connections to localhost only, but malware running locally can still connect.

## What Developers Need to Know

1. If you use Electron/Chromium-based frameworks, App-Bound Encryption requires code signing. Self-signed certificates will not work for production.
2. Any tool that relied on reading Chrome cookies directly from disk (testing frameworks, automation tools) is broken and must migrate to the new API.
3. CDP-based bypasses will eventually be patched. The long-term solution is hardware-backed key storage (TPM/Secure Enclave), which Chrome is targeting for v150+.

## The Bottom Line

App-Bound Encryption raises the cost of credential theft from "trivial" to "requires process injection." It is not a silver bullet — determined attackers will still find ways into Chrome process memory. But it eliminates the easiest attack vector, which accounts for 90%+ of current infostealer incidents. That is a meaningful security improvement.

App-Bound Encryption in Chrome 148: What Changed and Why Credential Theft Just Got Harder

// COMMENTS

ON THIS PAGE