The infostealer uses a first‑seen‑in‑the‑wild debugging method to extract Chrome’s decryption key without privilege escalation, raising concerns about the future of browser data security.

CSO Online offers insights into cybersecurity, risk management, and IT leadership, providing articles, reports, and expert analysis to help security professionals navigate the evolving threat landscape and protect their organizations from cyber attacks. By exploring CSO Online's curated content, CISOs, security managers, and IT executives can learn about threat intelligence, security frameworks, and incident response strategies for building resilient cybersecurity programs. Whether you're defending against ransomware, phishing attacks, or insider threats, CSO Online offers resources to strengthen your security posture and safeguard your digital assets.

CSO Online

A new infostealer called VoidStealer has been discovered that bypasses Chrome's Application-Bound Encryption (ABE) using a novel debugger-based technique not previously seen in the wild. Unlike earlier ABE bypass methods that required admin privileges or code injection, VoidStealer attaches as a debugger and uses hardware breakpoints to intercept Chrome's decryption flow at the exact moment the v20_master_key appears in plaintext memory, then reads it via standard debugging APIs. This approach requires no privilege escalation and leaves memory untouched, making it stealthier than alternatives. Active since December 2025, the malware operates as a Malware-as-a-Service (MaaS) and has already gone through 12 versions. Defenders are advised to monitor for unexpected debugger attachments to browser processes, unusual memory-reading API usage, and anomalous Chrome process spawning.

Chrome ABE bypass discovered: New VoidStealer malware steals passwords and cookies