Google has implemented various strategies to combat cyber threats, including Safe Browsing download protection in Chrome, Device Bound Session Credentials, and account-based threat detection systems that notify users of stolen cookie misuse.
The persistent risk posed by cybercriminals using cookie theft malware remains a significant concern for user safety and security. In response, Google is unveiling an additional protective measure to enhance the security of Windows users against this malware.
Currently, Chrome employs robust techniques to secure sensitive data like cookies and passwords on each operating system. On macOS, Chrome uses Keychain services; on Linux, it relies on system-provided wallets such as kwallet or gnome-libsecret. For Windows, Chrome utilizes the Data Protection API (DPAPI) to safeguard data at rest from unauthorized users or cold boot attacks.
However, DPAPI does not protect against malicious applications that execute code as the logged-in user, which is a common tactic of infostealers.
Introducing App-Bound Encryption
With the release of Chrome 127 for Windows, Google introduces App-Bound Encryption to enhance data security. This method ensures that only Chrome can access encrypted data by incorporating the app’s identity into the encryption process.
The App-Bound service, operating with system privileges, blocks unauthorized apps from decrypting data. Alongside other measures like cookie decryption event logs, this update increases the difficulty and detection risk for attackers trying to steal user data.
This protection is particularly useful in enterprise environments where users are not granted administrative rights to run downloaded files.
How It Works
In such environments, malware cannot easily request elevated privileges and must use more detectable techniques like injection. App-Bound Encryption strongly ties the encryption key to the machine, which means it won’t work correctly if Chrome profiles move between multiple machines.
For enterprises that support roaming profiles, Google advises following best practices. The new ApplicationBoundEncryptionEnabled policy can configure app-bound encryption if needed.
Chrome logs an event when a verification fails to help identify any incompatibilities. The event is ID 257 from the ‘Chrome’ source in the Application log.
App-bound encryption raises the cost of data theft for attackers and makes their actions more noticeable on the system. It helps defenders define acceptable behavior for other apps more clearly.
As the threat landscape evolves, Google remains committed to collaborating with the security community to improve detections and strengthen operating system protections, such as enhanced app isolation primitives, to address any bypasses.
