- Description
- A cookie encryption bypass vulnerability exists in Google Chrome’s AppBound mechanism due to weak path validation logic within the elevation service. When Chrome encrypts a cookie key, it records its own executable path as validation metadata. Later, when decrypting, the elevation service compares the requesting process’s path to this stored path. However, due to path canonicalization inconsistencies, an attacker can impersonate Chrome (e.g., by naming their binary chrome.exe and placing it in a similar path) and successfully retrieve the encrypted cookie key. This allows malicious processes to retrieve cookies intended to be restricted to the Chrome process only. Confirmed in Google Chrome with AppBound Encryption enabled. Other Chromium-based browsers may be affected if they implement similar COM-based encryption mechanisms.
- Source
- disclosure@vulncheck.com
- NVD status
- Awaiting Analysis
CVSS 4.0
- Type
- Secondary
- Base score
- 9.3
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- CRITICAL
- disclosure@vulncheck.com
- CWE-287
- Hype score
- Not currently trending
C4 Bomb: Blowing Up Chrome’s AppBound Cookie Encryption(CVE-2025-34090, CVE-2025-34091 & CVE-2025-34092) https://t.co/JKQescwdmI "...C4 allowed us to decrypt the cookies as a low-privileged user... typically only be available to the privileged SYSTEM user..." @CyberArk
@xvonfers
2 Jul 2025
1296 Impressions
3 Retweets
13 Likes
7 Bookmarks
0 Replies
0 Quotes
CVE-2025-34092 A cookie encryption bypass vulnerability exists in Google Chrome’s AppBound mechanism due to weak path validation logic within the elevation service. When Chrome encr… https://t.co/D658FLHjBu
@CVEnew
2 Jul 2025
480 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes