We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2025-34092

Chrome Cookie Key Exposure via AppBound COM Path Validation Weakness



Description

A cookie encryption bypass vulnerability exists in Google Chrome’s AppBound mechanism due to weak path validation logic within the elevation service. When Chrome encrypts a cookie key, it records its own executable path as validation metadata. Later, when decrypting, the elevation service compares the requesting process’s path to this stored path. However, due to path canonicalization inconsistencies, an attacker can impersonate Chrome (e.g., by naming their binary chrome.exe and placing it in a similar path) and successfully retrieve the encrypted cookie key. This allows malicious processes to retrieve cookies intended to be restricted to the Chrome process only. Confirmed in Google Chrome with AppBound Encryption enabled. Other Chromium-based browsers may be affected if they implement similar COM-based encryption mechanisms.

Reserved 2025-04-15 | Published 2025-07-02 | Updated 2025-07-02 | Assigner VulnCheck


CRITICAL: 9.3CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Problem types

CWE-287 Improper Authentication

CWE-706 Use of Incorrectly-Resolved Name or Reference

CWE-290 Authentication Bypass by Spoofing

Product status

Default status
unknown

127 before 129
affected

Credits

Ari Novick of CyberArk Labs finder

References

www.cyberark.com/...ng-up-chromes-appbound-cookie-encryption technical-description third-party-advisory

vulncheck.com/...es/google-chrome-appbound-cookie-encryption third-party-advisory

cve.org (CVE-2025-34092)

nvd.nist.gov (CVE-2025-34092)

Download JSON

Share this page
https://cve.threatint.eu/CVE/CVE-2025-34092

Support options

Helpdesk Chat, Email, Knowledgebase