AnalysisPublished 6 May 2026

How VoidStealer bypasses Chrome’s protections to hijack sessions and steal data | Kaspersky official blog

Source Kaspersky Security Blog

Description

The VoidStealer malware employs a new technique to circumvent Chrome’s App-Bound Encryption mechanism, gaining access to session cookies and other sensitive user data.

Impact

The malware enables attackers to bypass Chrome's intended protection of session cookies and sensitive data, allowing hijacking of authenticated sessions and theft of personal or financial information. This undermines the security improvements introduced by App-Bound Encryption, exposing users of Chrome and other Chromium-based browsers on Windows to data theft. The malware's debugger-based memory extraction technique does not require privilege escalation but relies on the ability to run code with the user's privileges. The widespread availability of VoidStealer as malware-as-a-service increases the risk of mass infections. There is no indication that this threat currently exploits zero-day vulnerabilities or that it is actively exploited in the wild at scale.

Defensive guidance

Users should avoid installing software from untrusted sources to reduce infection risk. Keeping operating systems and software up to date is recommended to mitigate exploitation of known vulnerabilities. Use robust security solutions to detect and block suspicious activities in real time. Avoid storing passwords and financial information directly in browsers; instead, use dedicated secure password managers. Since the malware exploits a runtime memory exposure, traditional encryption mechanisms alone may not suffice.

References

kaspersky.com/blog/chrome-application-bound-encryption-bypass-voidstealer/55735/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 6 May 2026, 11:52 UTC

References

Community reviews