New CDP Attack Targets Live Browser Sessions on Windows

A recently disclosed post-exploitation technique allows attackers to hijack live sessions in Google Chrome and Microsoft Edge after compromising Windows systems. This method leverages the Chrome DevTools Protocol (CDP) to access authenticated sessions without needing to steal cookies. The attack requires prior code execution on the victim's machine, making it particularly dangerous for users with active browser sessions. Affected users include anyone running these browsers on compromised Windows systems. The technique exposes sensitive data, including browser activity, WebAuthn interactions, and extensions, while bypassing existing protections against cookie theft. The full scope of the attack's impact is still being assessed, but it poses a significant risk to user security. Current mitigation strategies are not detailed in the articles, indicating an urgent need for awareness and defensive measures.

Key Points: • Attackers can hijack live sessions in Chrome and Edge via a new CDP technique. • The method requires prior code execution on Windows systems. • Sensitive browser data and authenticated sessions are at risk without cookie theft.