Chrome Cookie Theft on macOS, and How To Prevent It

The talk starts from a simple question: if malware runs as a user on a MacBook, can it read that user's Chrome cookies? The speaker, who works on a security team, argues that browser sessions are now valuable because much of a person's email and SaaS access lives there. macOS code signing and process isolation stop one signed app from freely controlling another, but Chrome's design leaves several openings.

Three attack paths are covered. The first abuses Chrome's remote debugging server, which can be asked for every cookie over a local port. The second copies the cookie database, whose values are encrypted with a key held in the login keychain that a signed Chrome binary can read, so the encryption adds limited protection. The third replaces the network service binary inside the app bundle, kills it so Chrome relaunches it, and passes the key and cookie access to a process the attacker controls.

For defense, the speaker recommends disabling remote debugging through a Chrome Enterprise policy, using Santa file authorization so only Chrome's network helper can open the cookie file, and protecting the policy folder so deleting it cannot open a startup window. For detection, osquery can flag network service launches from any parent other than Chrome, and extension inventories help spot suspicious add-ons. The Q&A compares Firefox, Safari, Chromium forks and Electron apps, and the speaker admits there is no fix yet for the IPC attack.