Full Report
Cybersecurity researchers have detailed a post-exploitation technique that enables the Chrome DevTools Protocol (CDP) inside a running Google Chrome or Microsoft Edge process on Windows, allowing an operator to access cookies, saved data, and authenticated browser sessions. The technique assumes that an operator already has code execution on the Windows host and does not involve
Analysis Summary
# Tool/Technique: Chrome DevTools Protocol (CDP) Injection
## Overview
This is a post-exploitation technique that enables the Chrome DevTools Protocol (CDP) inside an already running Google Chrome or Microsoft Edge process on Windows. By activating the debugging server internally, an attacker can bypass recent security enhancements like App-Bound Encryption (ABE) to hijack authenticated sessions, steal cookies, and interact with the browser in the victim's context without needing to restart the browser with suspicious command-line flags.
## Technical Details
- **Type:** Technique / Post-Exploitation Tool
- **Platform:** Windows (x64)
- **Capabilities:** Process injection, remote debugging activation, session hijacking, credential theft.
- **First Seen:** Concept discussed since 2018; specific "CDP-Enable-BOF" implementation detailed August 2026.
## MITRE ATT&CK Mapping
- **TA0005 - Defense Evasion**
- T1055 - Process Injection
- **TA0006 - Credential Access**
- T1539 - Steal Web Cookies
- T1555 - Credentials from Password Stores
- **TA0009 - Collection**
- T1119 - Automated Collection
- T1113 - Screen Capture
## Functionality
### Core Capabilities
- **In-Memory Activation:** Enables the `StartRemoteDebuggingServer` function within a live `chrome.exe` or `msedge.exe` process without a restart.
- **Symbol Resolution:** Uses masked byte signatures to find internal Chromium symbols across different versions of `chrome.dll` or `msedge.dll`.
- **Session Persistence:** Bypasses Google's Chrome 136+ restriction that ignores remote debugging flags when targeting the default user data directory.
- **Thread Hijacking:** Executes calls on the browser's UI thread to ensure reliability against Control Flow Guard (CFG) and Shadow Stacks (CET).
### Advanced Features
- **Authenticated Proxying:** Allows an attacker to proxy HTTP/HTTPS traffic through the victim’s browser, inheriting all active login sessions (MFA bypass).
- **Interactive Screencasting:** Provides a remote view of the browser's content, allowing attackers to see what the user sees or interact with offscreen tabs.
- **Autofill Exploitation:** Triggers Chromium’s internal autofill to extract plaintext usernames and passwords for specific sites.
## Indicators of Compromise
- **File Names:** `CDP-Enable-BOF`, `CDP-Toolkit`.
- **Process Behaviors:**
- External processes (e.g., Cobalt Strike Beacons) performing injection into `chrome.exe` or `msedge.exe`.
- Browsers suddenly listening on unexpected local TCP ports (typically used for CDP).
- **Behavioral Indicators:**
- **Sysmon Event ID 8:** CreateRemoteThread detected targeting browser processes.
- **Sysmon Event ID 10:** ProcessAccess (OpenProcess) with high-privilege access masks targeting browsers.
## Associated Threat Actors
- **ToddyCat:** Known for using the related "Umbrij" malware which abuses CDP.
- **DeathFlamingo:** Credited with early research into injecting CDP into Edge.
## Detection Methods
- **Behavioral Detection:** Monitor for unexpected network listeners (ports) opened by browser processes that were not started with debugging flags.
- **Memory Scanning:** Use scanners to detect the presence of the injection stubs or unauthorized modifications in `chrome.dll`/`msedge.dll` memory space.
- **Endpoint Monitoring:** Alerts on any non-browser process attempting to call `OpenProcess` or `CreateRemoteThread` on a browser executable.
## Mitigation Strategies
- **Process Protection:** Enable Attack Surface Reduction (ASR) rules that prevent unauthorized process injection.
- **Endpoint Hardening:** Implement Windows Defender Exploit Guard to enforce CFG and CET, making exploitation more difficult.
- **Principle of Least Privilege:** Restrict administrative rights to prevent attackers from gaining the permissions necessary to inject into high-integrity processes.
- **Browser Updates:** Ensure Chrome/Edge are updated to versions (136+) that include the latest protections against external debugging attachment.
## Related Tools/Techniques
- **CDP-Enable-BOF:** The x64 Beacon Object File implementation of this technique.
- **CDP-Toolkit:** The suite used to interact with the browser once the port is open.
- **App-Bound Encryption (ABE):** The Google security feature this technique is designed to circumvent.
- **Living off the DevTools Protocol:** The broader research category of using built-in developer tools for malicious purposes.