Malware - VoidStealer Bypasses Chrome ABE to Steal Data

What Happened

A new infostealer named VoidStealer has emerged, successfully bypassing Chrome's Application-Bound Encryption (ABE). This security feature, introduced in Chrome 127, was designed to protect sensitive browser data like passwords and cookies by tightly encrypting them. Researchers have noted that VoidStealer employs a novel debugging technique that hasn't been seen in the wild before, making it a significant threat to browser security.

The bypass method used by VoidStealer is particularly concerning because it does not require privilege escalation or code injection, which are common in previous ABE bypass techniques. Instead, it attaches itself as a debugger to Chrome, waiting for the moment when the v20_master_key appears in plaintext in memory. This stealthy approach allows it to extract sensitive data without raising alarms.

Who's Being Targeted

VoidStealer primarily targets users of Google Chrome, which is one of the most widely used web browsers globally. Given the vast number of users, the potential impact of this malware is substantial. It can steal critical information such as passwords, cookies, and tokens, which can be exploited for identity theft and unauthorized access to personal accounts.

The malware has shown rapid evolution since its first appearance in December 2025, indicating that it is actively maintained and likely in high demand within underground markets. With multiple versions released, including the latest update on March 18, 2026, users must be vigilant.

Signs of Infection

Detecting VoidStealer can be challenging due to its stealthy nature. Traditional indicators of compromise may not be effective, as the malware avoids common detection methods. Researchers suggest monitoring for unusual behaviors, such as:

• Unexpected debugger attachments to browser processes
• Unusual use of memory-reading APIs
• Anomalous spawning patterns of Chrome processes

These signs can help users and security professionals identify potential infections before significant damage occurs.

How to Protect Yourself

To safeguard against VoidStealer and similar threats, users should adopt a proactive approach to their online security. Here are some recommended actions:

• Keep your browser updated: Regular updates can patch vulnerabilities that malware exploits.
• Use strong, unique passwords: Consider employing a password manager to generate and store complex passwords securely.
• Enable two-factor authentication (2FA): This adds an extra layer of security, making it harder for attackers to gain access to your accounts.
• Monitor your accounts: Regularly check for unauthorized access or unusual activity on your accounts.

By staying informed and implementing these protective measures, users can reduce their risk of falling victim to VoidStealer and other evolving malware threats.