Voidstealer 2.0 hijacks chrome by snatching its master key straight from ram

chrome’s vault is no longer locked. A new strain of Windows malware now yanks the browser’s master encryption key out of raw memory while the tab you just opened is still blinking awake.

Abe bypass arrives in the wild

Gen Digital’s threat-hunters caught VoidStealer 2.0 last week doing something academic papers only theorised: it waits for chrome to decrypt its own secrets at launch, then pickpockets the key before the browser finishes greeting the user. No code injection, no noisy DLL—just a suspended child process and a debugger handle the operating system hands over without a fight.

The trick sidesteps Google’s Application-Bound Encryption, a safeguard meant to tie secrets to a single, verified process. ABE still works—VoidStealer simply reads the unlocked plaintext from inside the same process family, a loophole the design never imagined. Once the key is gone, every stored password, cookie and credit card number is open for bulk export.

Detection is minimal because nothing is modified. Antivirus engines hunting for tampered binaries or injected threads see a calm, legitimate chrome.exe doing ordinary memory management. Only behaviour-based sensors that baseline chrome’s volatile memory footprint stand a chance, and even those must catch the microsecond between decryption and the first network ping.

Google has yet to publish a patch or even acknowledge the technique publicly. Chrome’s last stable update, pushed three days before Gen Digital’s report, fixed an unrelated zero-day in V8 and made no mention of memory-side channel defences. Until engineers either re-encrypt the master key on every IPC call or scramble the memory layout at boot, the attack window stays wide open.

The takeaway: if you are storing high-value credentials inside Chrome, treat the browser like a notebook left on a café table—convenient, but never safe. Move secrets to an offline token or a password manager that keeps its master key inside a separate secure enclave. The malware is already for sale in underground forums for a flat $2,000, payable in Monero. The price of complacency is higher.