When Google introduced Application-Bound Encryption (ABE) for Chrome in July 2024, it created a major obstacle for hackers trying to steal sensitive data such as passwords and cookies.
As browser security continues to evolve to protect users from high-severity vulnerabilities, malware authors constantly adapt their tactics.
Previously, malware could copy files from a computer. However, with ABE, the browser’s sensitive data is protected, forcing attackers to resort to noisy methods such as injecting malicious code to steal the decryption key.
Security experts have recently discovered a new information stealer named VoidStealer, which has developed a stealthy technique to bypass Google’s defenses without triggering alarms.
A Silent Approach To Stealing Keys
Most traditional malware bypasses ABE by injecting code directly into the browser to request the secret decryption key. Because this process modifies the browser’s memory, it is loud and easily caught by antivirus software.
VoidStealer, which first appeared on hacker forums in December 2025 and updated its tactics in March 2026, takes a completely different and much quieter approach.
Instead of injecting code, it attaches itself to the browser process, acting just like a legitimate software debugger. This advanced capability aligns with the broader trend of sophisticated infostealers continually targeting modern browser security mechanisms.
Once it finds the right spot, VoidStealer sets a hardware breakpoint. A hardware breakpoint is a special command that tells the computer’s processor to pause the browser at an exact moment.
Unlike software breakpoints, hardware breakpoints do not modify the browser’s memory, making them nearly invisible to standard security tools. When the browser hits the breakpoint and pauses, the master key is sitting fully exposed in the computer’s memory.
How Defenders Can Spot the Attack
Even though VoidStealer’s new method is designed to be invisible, security teams still have reliable ways to catch it. The entire attack depends on the malware acting as a debugger.
In a standard computer environment, regular everyday applications have no legitimate reason to debug a web browser.
If security tools detect an unknown or unauthorized program trying to attach a debugger to Chrome or Microsoft Edge, it is an immediate and obvious warning sign of an attack.
Additionally, monitoring how programs interact with memory can help stop this threat. While security software usually focuses heavily on preventing malicious code from being injected into memory, tracking unusual memory read activity is equally critical.
Benign gendigital applications rarely need to read a web browser’s internal memory. Finally, because VoidStealer needs to run a hidden browser instance to steal the key, defenders can actively search for browsers that launch invisibly, operate off-screen, or start in a suspended state.
These evasion tactics can provide the early warning needed to block the malware before any sensitive data is lost.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 for Chrome in July 2024, it created a major obstacle for hackers trying to steal){kind=link}