SpecterOps details CDP activation inside live Chrome and Edge on Windows
SpecterOps has detailed a Windows post-exploitation technique that activates the Chrome DevTools Protocol (CDP) inside a running Google Chrome or Microsoft Edge process. The approach, called CDP-Enable-BOF, can expose a browser's existing authenticated context on a requested CDP port, potentially giving an operator access to cookies, saved browser data and active sessions.
The technique is not a remotely exploitable Chrome or Edge vulnerability. It requires an operator to have already obtained code execution on the Windows host and sufficient access to manipulate the target browser process. It is also limited to x64 systems and requires a running Chrome or Edge process.
Starting debugging from inside the browser
Google changed Chrome's remote-debugging behaviour beginning with Chrome 136. When the default Chrome data directory is targeted, Chrome ignores the --remote-debugging-port and --remote-debugging-pipe switches unless a non-standard --user-data-dir is also supplied. Google said the alternative directory uses a different encryption key, a measure intended to protect browser data after attackers increasingly used remote debugging to extract cookies.
SpecterOps' approach does not launch a new browser with those switches. Its x64 Beacon Object File finds a live Chrome or Edge process and top-level window, identifies the loaded chrome.dll or msedge.dll, and resolves internal Chromium symbols with masked byte signatures. It then allocates remote memory for two small stubs and a context block, temporarily installs a remote window procedure, and makes the final call on the browser user-interface thread.
That call invokes Chromium's internal StartRemoteDebuggingServer function on the chosen port. The project says use of the UI thread improves reliability where CFG, TLS and CET-sensitive execution are present. The work builds on research by DeathFlamingo and Cedric Van Bockhaven into operating through the DevTools Protocol.
What an authenticated browser context can expose
Once the endpoint is enabled, SpecterOps' CDP-Toolkit can use CDP directly or automate internal browser WebUI surfaces. Listed workflows include cookie collection through Storage.getCookies, retrieval of history, bookmarks, extensions, screenshots and saved-password metadata, and password recovery through Chromium's autofill workflow for a matching origin.
The toolkit can also create an offscreen or background target for interactive screencasting, or proxy HTTP and HTTPS requests through browser targets that retain the victim's authenticated state. In screencast mode, cookies, browser storage, enterprise authentication state, WebAuthn behaviour, extensions and browser-specific JavaScript remain in the live local instance. That differs from replaying material elsewhere: Google's Device Bound Session Credentials, available to Windows users with Chrome 146, bind session refresh to a hardware-backed key. SpecterOps does not describe extracting that private key, but says operating within the authenticated browser can sidestep controls aimed at off-device replay.
Detection and version boundaries
SpecterOps recommends looking for injection activity targeting chrome.exe and msedge.exe. Microsoft Sysmon Event ID 8 records CreateRemoteThread activity, while Event ID 10 records ProcessAccess events. Microsoft notes that Event ID 8 can indicate code injection and that Event ID 10 can create substantial telemetry, so filtering expected activity is generally necessary.
The public BOF lists Chrome 147.0.7727.102 and Edge 147.0.3912.98 as tested versions, with version-specific signatures. Those builds trail later releases, including Chrome 151.0.7922.47/.48 in Early Stable and Edge 151.0.4129.78 in Stable. The repository includes scripts to derive new signatures when updates break symbol resolution, but does not establish that its bundled signatures work unchanged on newer builds. This follows Chrome fixes and browser-focused threats on Chrome fixes and browser-focused threats, underscoring why browser version inventory and endpoint telemetry need to be assessed together.
For security teams, the practical implication is to prioritise investigation of unusual cross-process access to live browsers, maintain browser patch inventory, and tune Sysmon monitoring around legitimate management activity before an incident requires rapid triage.