Stealing Browser Cookies: Bypassing the newest Chrome security measures

Rafael Felix opens with the scale of infostealer malware and why stolen session cookies have become a routine route into accounts. He points to recent data on stolen credentials and explains that browser vendors have responded by hardening how cookies and saved logins are stored on disk.

The core of the talk walks through how each browser family protects its data. For Chromium browsers on Windows, he traces the move from DPAPI to AES-256-GCM and then to Application-Bound Encryption, which hands key decryption to a privileged elevation service. He shows how the key blob is parsed after disassembling that service, then covers macOS keychain-derived keys and Linux keyring or fallback keys. He notes that Firefox leaves cookies in plain text while encrypting saved passwords, and describes the binary cookie format used by Safari.

The talk closes with Device Bound Session Cookies, which tie short-lived cookies to a key held in a TPM, and brainstorms possible weak points such as TPM key extraction, memory access during registration, and malware present at enrolment. A live demo runs an open-source Rust tool that exports cookies, credentials and other data from installed browsers. The takeaway for practitioners is that app-bound protection raises the bar for extraction on Windows without fully stopping it, and that DBSC is the next layer to watch.