App-Bound Encryption bypass: how infostealers raid your browser extensions

Two years ago, Google shipped a feature that was supposed to make one whole category of malware obsolete. It was called App-Bound Encryption, and the pitch was simple: even if a nasty program was running as you, on your account, it still couldn't read the cookies and passwords Chrome had saved. As of 2026, that promise has a hole in it — and the malware crawling through that hole is going straight for your browser extensions.

The threat: two infostealers that walk past Chrome's lock

Let me set the stage. When you save a password or stay logged into a site, Chrome stores that data on disk, encrypted. Before mid-2024, any program running under your Windows account could just decrypt it — no admin rights needed. Infostealers loved this. So in Chrome 127, Google rolled out App-Bound Encryption (ABE), which ties the decryption key to Chrome itself through a privileged Elevation Service, as the company explained on its security blog. The idea is that a random program pretending to be you can't ask for the key.

Good idea. But keys have to get decrypted somewhere, and that somewhere is memory.

In March 2026, Gen Digital researchers documented VoidStealer, which BleepingComputer reported is the first infostealer seen in the wild to defeat ABE using a debugger trick. Instead of attacking the encrypted file on disk, it attaches to Chrome's Elevation Service with a Windows hardware breakpoint and grabs the master key out of memory the instant it's decrypted — no administrator access required, according to the report.

Then there's Torg Grabber, another Gen Digital find. This one bypasses ABE through a companion tool that injects a DLL and talks to Chrome's Elevation Service to pull out the same master key. And here's the part that should get your attention: it's built to loot 850 browser extensions, per BleepingComputer's reporting on the research — 728 of them crypto wallets, 103 password managers and 2FA tools, and 19 note-taking apps.

Why extensions became the prize

For years, infostealers went after Chrome's built-in password and cookie stores. What changed is where the valuable secrets now live.

If you use a crypto wallet extension, your keys sit in that extension's local storage. If you use a password manager extension, its session and vault state can live there too. That's not a knock on those tools — it's just where the data has to be for the extension to work at all.

Torg Grabber's target list reads like the top shelf of the Chrome Web Store: MetaMask, Phantom, Trust Wallet, Coinbase, Exodus, OKX, Rabby, and Keplr on the wallet side, and LastPass, 1Password, and Bitwarden among the password managers, according to the research reported by BleepingComputer. The malware doesn't need to find a bug in any of those extensions. It steps around ABE at the operating-system level and reads whatever the browser has already decrypted into memory.

The researchers describe a fast-moving operation: 334 unique Torg Grabber samples compiled in roughly three months, new command-and-control domains registered weekly, and support for Chrome, Brave, Edge, Vivaldi, and Opera. On top of the extension theft, the reporting lists hardware fingerprinting, screenshot capture, and credential grabs from Discord, Telegram, Steam, and VPN clients. This is a product with a roadmap, not a one-off.

What the stolen master key actually unlocks

It helps to be precise about what's being taken, because "they stole my browser data" undersells it. That master key is the thing ABE was built to protect. Once it's out of memory, an attacker can decrypt the local stores it guards — saved passwords, session cookies, and the encrypted state that browser extensions keep on disk.

A stolen session cookie is worse than a stolen password in one specific way: it represents an already authenticated session. Feed it into an attacker's browser and they can be logged in as you without ever seeing your password or triggering your two-factor prompt.

For a crypto wallet extension, the equivalent is even more direct — if the material needed to unlock or drain the wallet is reachable in that decrypted state, there's no "reset password" that helps after the money moves. That's why extension-stored secrets have quietly become a primary data category for infostealer crews, sitting right alongside cookies and passwords.

The uncomfortable pattern

Here's what I keep coming back to. VoidStealer's ABE bypass wasn't invented from scratch — it was adapted from ElevationKatz, part of an open-source memory-dumping toolkit called ChromeKatz that had been public for over a year. That toolkit even ships an /inject flag built specifically to defeat App-Bound Encryption.

So the timeline goes: Google ships a defense, a proof-of-concept bypass gets published openly, and 12 to 18 months later an infostealer ships that bypass as a paid feature. We've watched the same arc with cookie theft — which is exactly why Chrome later added device-bound sessions. I broke down that other Chrome cookie defense, DBSC, in an earlier post, and the lesson rhymes: a single browser-level lock is never the whole story, and betting your security on one is how you get surprised.

How the infection actually starts

Before any of this memory-scraping can happen, something has to run on your machine. For Torg Grabber, that's ClickFix — a social-engineering trick where a fake "verify you're human" or "fix this error" page tells you to press Win+R, paste something, and hit Enter. What you paste is a PowerShell command that quietly downloads the malware.

No software vulnerability gets exploited there. You do. MITRE tracks this as a named technique, T1204.004 "Malicious Copy and Paste," and it has exploded across 2025 and 2026 as an initial-access method.

That's genuinely good news, because it means the single most effective thing you can do costs nothing: never paste a command you didn't write into a terminal or the Run box. A real CAPTCHA never asks you to do that. Neither does a legitimate "fix."

How to protect yourself

You can't personally patch how Chrome holds a key in memory. But you can shrink the blast radius, and most of this becomes muscle memory once you set it up.

1. Kill the ClickFix vector first. If a website ever tells you to open PowerShell, the Run dialog, or Terminal and paste something to "verify" or "fix" anything — close the tab. That one habit defeats the initial-access step for Torg Grabber and most of its cousins, and it's the cheapest defense on this list.

2. Don't keep life-changing money in a hot browser wallet. Browser extension wallets are convenient and fine for small, active balances. Serious holdings belong in a hardware wallet that signs transactions on-device and never exposes its keys to the browser at all. If you want the specifics on which wallet extensions hold up and where they don't, I went through MetaMask, Phantom, and Trust Wallet in a dedicated review.

3. Turn on every non-cookie lock your accounts offer. A stolen session cookie or master key is worth far less against accounts protected by hardware-key 2FA (a passkey or a YubiKey), phishing-resistant login, and short session lifetimes that force frequent re-authentication. For password managers specifically, I dug into how the big vaults handle extension-level risk here.

4. Audit what's actually installed. Every extension you've forgotten about is another chunk of local storage sitting in browser memory, and abandoned or over-permissioned extensions are a favorite hiding spot for both direct malware and the data these stealers scoop up. Prune ruthlessly — if you don't use it most weeks, remove it. Fewer extensions means less decrypted state for a stealer to find.

5. Assume a wipe means a rotation. If you ever suspect an infostealer hit — a weird PowerShell prompt you half-followed, a surprise download, a browser that acted strange — don't just run an antivirus scan and move on. Rotate passwords, revoke active sessions everywhere, and move any crypto to fresh keys from a device you trust. VoidStealer is designed to leave few forensic artifacts, so the absence of an alert is not proof you're clean.

How Extenshi helps

This whole class of attack rewards the extensions you've stopped thinking about. That's the gap Extenshi is built to close. The catalog scans extensions across Chrome, Firefox, and Edge for exactly the traits that make them risky targets and risky tenants — excessive permissions, sketchy update history, and behavior that doesn't match what the listing claims.

You can check any extension's security report before you trust it with your session or your seed phrase. And if you want to see what's already sitting in your browsers right now, npx @extenshi/guard scan will inventory your installed extensions and let you disable or remove the sketchy ones with an undo — no account needed for the scan. App-Bound Encryption can't save you from an extension you should never have installed. A five-minute audit can.

Scan your extensions → catalog.extenshi.io

Sources

• Improving the security of Chrome cookies on Windows — Google Online Security Blog
• VoidStealer malware steals Chrome master key via debugger trick — BleepingComputer
• New Torg Grabber infostealer malware targets 728 crypto wallets — BleepingComputer
• ChromeKatz / ElevationKatz — Meckazin (GitHub)
• T1204.004 Malicious Copy and Paste — MITRE ATT&CK

---

This article is based on publicly available security research and news reporting. Extenshi does not independently verify all claims made by third-party researchers. References to specific companies or products reflect the findings of cited sources and do not constitute accusations of intentional wrongdoing. If you believe any information is inaccurate, please contact us at [email protected].