Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers

SpecterOps has detailed a post-exploitation technique leveraging the Chrome DevTools Protocol (CDP) to hijack authenticated browser sessions in live Google Chrome or Microsoft Edge processes on Windows. The technique requires prior code execution and manipulates the running browser process to enable remote debugging via a Beacon Object File (BOF), allowing attackers to extract cookies, saved passwords, browsing history, and perform browser takeover. The method bypasses protections like App-Bound Encryption by operating within the victim's existing browser context, and relies on process injection into chrome.exe or msedge.exe, detectable via Sysmon Event IDs 8 and 10.

AI-extracted · verify before operational use