C4 BOMB: BLOWING UP CHROME'S APPBOUND COOKIE ENCRYPTION

Summary from the TLDR InfoSec newsletter

C4 (Chrome Cookie Cipher Cracker) is a technique that defeats Google's AppBound Cookie Encryption, which was introduced in July 2024 to protect against infostealers. The attack exploits a padding oracle vulnerability to decrypt cookies as a low-privileged user, ironically turning Chrome's security feature into an attack vector for accessing SYSTEM-level data on Windows machines. New security implementations can inadvertently create novel attack surfaces when not properly hardened against cryptographic vulnerabilities.