C4 Bomb” Exploit Breaks Chrome App-Bound Cookie Encryption in the Wild

Security researchers at CyberArk Labs have uncovered two critical vulnerabilities in Google Chrome’s AppBound Cookie Encryption, a security feature introduced in July 2024 to protect browser cookies from theft.

The attacks—dubbed “COM Hijacking” and “C4 Bomb” (Chrome Cookie Cipher Cracker)—allow low-privileged attackers to bypass encryption designed to prevent cookie theft by infostealer malware.

COM Hijacking:

Chrome’s AppBound encryption relies on a SYSTEM-level COM server (elevation service) to decrypt cookies.

Researchers found this service vulnerable to COM hijacking, where attackers can manipulate registry entries (HKCU\Software\Classes\CLSID) to redirect Chrome to a malicious or non-existent DLL.

When Chrome fails to load the legitimate service (e.g., due to a fake aaa.dll reference), it reverts to the older DPAPI encryption method, which low-privileged malware can easily decrypt.

This attack requires no elevated permissions but renders previously encrypted cookies inaccessible until Chrome re-encrypts them using the compromised method.

C4 Bomb:

The more sophisticated C4 Bomb attack exploits cryptographic weaknesses in Chrome’s dual-layer DPAPI encryption.

By sending manipulated ciphertexts to the elevation service, attackers use Windows Event Viewer logs as a padding oracle to validate guesses.

The process leverages:

• AES-CBC mode vulnerabilities: Bit-flipping attacks modify ciphertext blocks to alter the plaintext.
• DPAPI’s fixed initialization vector (IV): Enables predictable decryption of non-IV blocks.
• PKCS7 padding errors: Event Viewer logs distinguish invalid padding (“reason: unknown”) from signature failures (“MAC check failed”)1.

python# Simplified C4 Attack Pseudocode
decrypted_blob = ""
for block_index in range(1, total_blocks):
    for byte_position in range(16):
        for guess in range(256):
            modified_cipher = flip_cipher_byte(previous_block, byte_position, guess)
            send_to_elevation_service(modified_cipher)
            if event_log_show_padding_error():
                decrypted_byte = guess ^ expected_padding
                decrypted_blob += decrypted_byte

The attack cracks SYSTEM-DPAPI encryption in ~16 hours, revealing user-DPAPI blobs decryptable via CryptUnprotectData.

Implications and Vendor Responses

These attacks expose systemic risks:

1. Broader DPAPI compromise: C4 can decrypt any SYSTEM-DPAPI data (e.g., Windows Credential Manager entries).
2. Design flaws: Delegating decryption to a SERVICE without robust path validation creates attack surfaces.
3. Vendor mitigation: Google implemented a partial fix (disabled by default) but plans comprehensive patches. Microsoft rejected the vulnerability, citing “low practical exploitability”.

Security experts urge abandoning AES-CBC due to recurrent padding oracle flaws, emphasizing that AppBound’s complexity introduced unforeseen attack vectors.

The findings underscore the challenge of retrofitting legacy systems (DPAPI) into modern security frameworks.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates