CVE-2025-34090

Description

A security bypass vulnerability exists in Google Chrome AppBound cookie encryption mechanism due to insufficient validation of COM server paths during inter-process communication. A local low-privileged attacker can hijack the COM class identifier (CLSID) registration used by Chrome's elevation service and point it to a non-existent or malicious binary. When this hijack occurs, Chrome silently falls back to the legacy cookie encryption mechanism (protected only by user-DPAPI), thereby enabling cookie decryption by any user-context malware without SYSTEM-level access. This flaw bypasses the protections intended by the AppBound encryption design and allows cookie theft from Chromium-based browsers. Confirmed in Google Chrome with AppBound Encryption enabled. Other Chromium-based browsers may be affected if they implement similar COM-based encryption mechanisms.

Reserved 2025-04-15 | Published 2025-07-02 | Updated 2025-07-03 | Assigner VulnCheck

Problem types

CWE-426 Untrusted Search Path

CWE-276 Incorrect Default Permissions

Product status

Default status
unaffected

127 before 129
affected

Credits

Ari Novick of CyberArk Labs finder

References

www.cyberark.com/...ng-up-chromes-appbound-cookie-encryption technical-description third-party-advisory

vulncheck.com/...es/google-chrome-appbound-cookie-encryption third-party-advisory

cve.org (CVE-2025-34090)

nvd.nist.gov (CVE-2025-34090)

Download JSON