CVE-2025-34090 – “Google Chrome AppBound Cookie Encryption Bypass”

CVE ID : CVE-2025-34090

Published : July 2, 2025, 8:15 p.m. | 37 minutes ago

Description : A security bypass vulnerability exists in Google Chrome AppBound cookie encryption mechanism due to insufficient validation of COM server paths during inter-process communication. A local low-privileged attacker can hijack the COM class identifier (CLSID) registration used by Chrome’s elevation service and point it to a non-existent or malicious binary. When this hijack occurs, Chrome silently falls back to the legacy cookie encryption mechanism (protected only by user-DPAPI), thereby enabling cookie decryption by any user-context malware without SYSTEM-level access. This flaw bypasses the protections intended by the AppBound encryption design and allows cookie theft from Chromium-based browsers.

Confirmed in Google Chrome with AppBound Encryption enabled. Other Chromium-based browsers may be affected if they implement similar COM-based encryption mechanisms.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…