VoidStealer Malware Bypasses Chrome ABE to Steal Sensitive Data

VoidStealer, a new infostealer malware, has been identified as the first to bypass Google Chrome's Application-Bound Encryption (ABE) using a novel debugger-based technique. This method allows it to extract the v20_master_key, which is crucial for decrypting sensitive browser data like passwords and cookies, directly from memory without requiring privilege escalation or code injection. The malware, which operates as a malware-as-a-service (MaaS) platform, was first observed in the wild in December 2025 and has rapidly evolved, with version 2.0 introducing this stealthy bypass method. Researchers from Gen Digital noted that while ABE was designed to protect sensitive data, the key still exists in plaintext during decryption operations, which VoidStealer exploits. The malware's technique involves attaching a debugger to a hidden browser process and setting hardware breakpoints to intercept the master key during its brief presence in memory. This development poses a significant risk to users of Chrome and other browsers utilizing ABE, as it represents a shift in the tactics employed by infostealers.

Key Points: • VoidStealer is the first malware to bypass Chrome's ABE using a debugger-based technique. • The malware extracts the v20_master_key from memory without needing privilege escalation or code injection. • VoidStealer operates as a malware-as-a-service and has rapidly evolved since its introduction.