Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

CDP-Enable-BOF activates Chrome DevTools Protocol inside live Windows browsers for post-exploitation session access

Technical Analysis
First reported
Last updated
Happening score
H score 23
1 unique sources, 1 articles

Summary

Hide ▲

CDP-Enable-BOF now enables Chrome DevTools Protocol access inside a live Google Chrome or Microsoft Edge process on Windows, raising the risk of cookie theft and authenticated session hijacking after initial compromise. The technique works from within the existing browser process rather than through a browser vulnerability, which expands post-exploitation options for operators with code execution on the host. Defenders can hunt for process-injection behavior against chrome.exe and msedge.exe and for abnormal remote-debugging activity.

Related Happenings

NVIDIA NemoClaw Ollama browser-to-localhost control security flaw

Vulnerability
H score15 First: 25.08.2026 17:07 Last: 25.08.2026 17:07 Sources 1

About this happening: A malicious webpage can exploit NVIDIA NemoClaw's Ollama backend when it is bound to 0.0.0.0:11434, enabling unauthenticated local control of the model API. The at...

Open Happening

AIT-GUI unauthenticated command execution security flaw

Vulnerability
H score32 First: 18.08.2026 17:30 Last: 18.08.2026 17:30 Sources 1

About this happening: AIT-GUI has a critical unauthenticated command-execution vulnerability affecting versions through 2.5.1, with a fix in 2.5.2. Attackers could reach /cmd, /sc...

Open Happening

Sysmon detection for Chrome and Edge process injection during CDP-enabled post-exploitation

Defensive Guidance
H score11 First: 14.08.2026 14:07 Last: 14.08.2026 14:07 Sources 1

How related: SpecterOps said defenders can look for signs of process injection targeting chrome.exe and msedge.exe using Sysmon Event IDs 8 and 10.

About this happening: A concrete Sysmon hunt for chrome.exe and msedge.exe injection now helps Windows defenders spot CDP-enabled post-exploitation before authenticated browser sessions...

Open Happening

ClickFix AmnesiaStealer distribution campaign targeting mac users

Campaign
H score22 First: 14.08.2026 13:45 Last: 14.08.2026 13:45 Sources 1

About this happening: A ClickFix campaign is distributing AmnesiaStealer to macOS users through a counterfeit GitHub "Download for macOS" page and a copy-and-paste command that launches...

Latest development: 16.08.2026 18:07

Jamf described AmnesiaStealer's stream_module and remote_stream commands, which copy a victim's Chromium profile into a hidden headless browser and open WebSocket and Chrome DevTools Protocol channels through webSocketDebuggerUrl. The operator can issue navigation and mouse commands, receive live screencasts, and export or import cookies to operate online portals inside the victim's authenticated sessions on Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium.

Open Happening

AmnesiaStealer macOS infostealer distributed via ClickFix

Malware Activity
H score16 First: 14.08.2026 13:45 Last: 14.08.2026 13:45 Sources 1

About this happening: AmnesiaStealer is a Rust-based macOS infostealer spread through a counterfeit GitHub "Download for macOS" page and ClickFix-style lure. It steals Keychain, b...

Open Happening

Timeline

  1. 14.08.2026 14:07 2 articles · 13d ago

    SpecterOps details CDP-Enable-BOF for live Chrome and Edge session access

    Initial Disclosure

    SpecterOps describes CDP-Enable-BOF, a post-exploitation technique that activates the Chrome DevTools Protocol inside a running Google Chrome or Microsoft Edge process on Windows so an operator with prior code execution can access cookies, saved data, and authenticated browser sessions. The technique works from inside chrome.exe or msedge.exe rather than by exploiting a browser vulnerability, and defenders are advised to watch for process injection and unexpected remote-debugging activity with Sysmon Event IDs 8 and 10.

    Show sources
    Open in new tab