VoidStealer Bypasses Chrome ABE, Steals Data Without Injection

Key Takeaways

• A new variant of the VoidStealer infostealer (version 2.0, released March 13, 2026) can bypass Google Chrome’s Application-Bound Encryption (ABE).
• This bypass is notable because it does not require code injection or elevated system privileges, making it stealthier than previous methods.
• VoidStealer achieves this by using a debugger-based technique to extract the master encryption key directly from memory when it is temporarily in plaintext.
• The malware targets both Google Chrome and Microsoft Edge, and its technique, derived from the open-source ElevationKatz project, is expected to be adopted by other infostealers.
• Defenders should monitor for unusual debugger attachments to browsers and processes launching browsers with hidden or suspended flags.

VoidStealer Infostealer Evades Chrome ABE Without Injection

Cybersecurity researchers are currently observing a sophisticated new variant of the VoidStealer infostealer. This updated malware is the first of its kind to circumvent Google Chrome’s Application-Bound Encryption (ABE) without needing code injection or elevated system privileges, posing a significant challenge to existing browser security measures.

The latest iteration, VoidStealer version 2.0, which surfaced on March 13, 2026, employs a debugger-based approach to covertly exfiltrate encrypted browser credentials directly from memory. This method represents a notable evolution in how infostealers attempt to steal sensitive user data.

Understanding Google Chrome’s ABE Protection

Google introduced ABE in July 2024 with the release of Chrome 127. The primary goal of this security feature was to significantly enhance the difficulty for malware to access sensitive browser data, including saved passwords and cookies.

ABE operates by linking the encryption key, known as the v20_master_key, to a SYSTEM-level service called the Google Chrome Elevation Service. This service runs with the highest possible privileges on Windows systems, thereby protecting the key.

While ABE significantly raised the security bar, threat actors have consistently sought and found methods to bypass it. Since its implementation, several bypass techniques have emerged, each presenting various trade-offs between operational stealth and reliability.

VoidStealer’s Evolution and Impact

Analysts at GenDigital first identified VoidStealer as a Malware-as-a-Service (MaaS) offering. It initially appeared on dark web forums, including HackForums, in mid-December 2025.

The malware has undergone rapid development, progressing from version 1.0 to 2.1 in just over three months. Earlier versions of VoidStealer relied on known injection-based bypasses. However, version 2.0 introduced an innovative technique adapted from the open-source ElevationKatz project, making VoidStealer the first infostealer observed in the wild to utilize this specific method.

The significant danger of this new variant lies in its exceptionally low detection footprint. Most existing ABE bypass techniques either necessitate SYSTEM-level privileges or involve direct code injection into the browser process. These actions are typically easier for security tools to detect.

VoidStealer’s updated methodology bypasses both these requirements. Instead, it leverages standard Windows debugging APIs, which generate significantly less scrutiny in typical operating environments. This makes the malware considerably harder to detect, and its consistent, rapid update cycle indicates active and ongoing development by its creators.

Currently, VoidStealer targets both Google Chrome and Microsoft Edge. Given that the underlying technique is now publicly available via ElevationKatz, researchers anticipate that other infostealers will soon adopt similar bypass methods.

Debugger-Based ABE Bypass Mechanism Explained

The core of VoidStealer’s novel bypass involves attaching itself to the Chrome or Edge browser as a debugger. It then strategically places hardware breakpoints at the precise moment when the v20_master_key is briefly exposed in plaintext within memory.

The attack sequence begins with VoidStealer spawning a browser process using CreateProcessW, employing the SW_HIDE and CREATE_SUSPENDED flags. After immediately resuming the process, it attaches a debugger via DebugActiveProcess. The malware then monitors for debug events using WaitForDebugEvent, tracking each DLL as it loads into the browser’s memory space.

Once either chrome.dll or msedge.dll is loaded, VoidStealer utilizes ReadProcessMemory to scan the DLL’s .rdata section for the specific string OSCrypt.AppBoundProvider.Decrypt.ResultCode. This string marks the exact point in Chrome’s code where the v20_master_key briefly appears in an unencrypted state. Subsequently, it scans the .text section to pinpoint the corresponding LEA instruction, which serves as the precise address for setting the breakpoint.

Hardware breakpoints are then distributed across all browser threads by writing to the DR0 and DR7 debug registers through SetThreadContext. Crucially, this process avoids any direct modification of the browser’s memory. When the breakpoint is triggered, the R15 register for Chrome or the R14 register for Edge contains a direct pointer to the v20_master_key. VoidStealer then extracts this key using just two ReadProcessMemory calls.

What You Should Do

• Monitor Debugger Attachments: Implement robust monitoring for any process attempting to attach a debugger to web browser processes (e.g., chrome.exe, msedge.exe). Legitimate applications rarely perform this action autonomously.
• Detect Hidden/Suspended Browser Launches: Configure alerts for browser processes initiated with flags like SW_HIDE or CREATE_SUSPENDED, as this behavior is often indicative of malicious activity.
• Analyze DebugActiveProcess Calls: Actively monitor and flag unexpected calls to DebugActiveProcess that target browser processes.
• Endpoint Detection and Response (EDR): Ensure EDR solutions are configured to detect and alert on suspicious memory access patterns or API calls originating from non-browser processes targeting browser memory.
• Keep Software Updated: While this bypass targets a security feature, maintaining up-to-date operating systems, browsers, and security software is always crucial to mitigate other vulnerabilities.
• Indicator of Compromise (IOC): The known SHA256 hash for VoidStealer v2.0 is f783fde5cf7930e4b3054393efadd3675b505cbef8e9d7ae58aa35b435adeea4. Add this to your threat intelligence and scanning tools.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.