Developers across major commodity infostealer operations—including Lumma Stealer, StealC, MeduzaStealer, and Vidar—have deployed functional bypasses against Google Chrome’s App-Bound Encryption (ABE) mechanism introduced in version 127. Designed to replace legacy user-mode DPAPI encryption, ABE delegates master key encryption to a privileged Windows service (elevation_service.exe) running under NT AUTHORITY\SYSTEM and communicating via the IElevator COM interface. By verifying the calling process path and binary signatures, the mechanism was intended to block untrusted malware executing within a user session from decrypting SQLite cookie and credential stores.

Security researchers confirmed that adversaries rapidly circumvented this security boundary by weaponizing several unprivileged execution techniques on Windows. Stealers now inject shellcode into legitimate Chrome processes, hijack the IElevator COM client context, or spawn browser instances configured with the --remote-debugging-port flag to extract live session tokens directly from Chromium memory. While Google framed ABE as a progressive hardening defense to force malware into louder, detectable system-level activities, threat actors successfully restored automated, silent cookie extraction under standard user privileges across Chrome 127 through 129 without triggering User Account Control (UAC) prompts or endpoint alarms.

Why it matters:

• Technical & Architecture Risk: Arbitrary code execution within a user’s desktop session inherently undermines OS-level application-bound encryption, as adversaries can leverage process injection, COM context hijacking, or debugging flags to coerce the host binary into decrypting secrets on their behalf.
• Strategic & Defender Imperative: Security teams cannot rely on browser-level encryption to mitigate infostealer risks and must prioritize endpoint injection detection, restrict unauthorized Chromium command-line switches, enforce device-bound session credentials (DBSC), and deploy continuous session revocation across identity providers.