The VoidStealer malware steals passwords – Chrome ABE bypass

A new infostealer -type malware is bypassing Application-Bound Encryption (ABEChrome’s ) , using a debugger-based technique that researchers say has not been seen before. It’s called “ VoidStealer ” and it appears to have found a way to bypass ABE , which was introduced in Chrome 127 in 2024. ABE is a security check that aims to protect sensitive browser data (e.g. passwords and cookies) behind stronger encryption by linking decryption to a privileged system service.

ABE bypasses have existed in the past, through code injection in Chrome, COM/elevation service abuse, and remote debugging. However, almost all of these techniques required administrator privileges.

Vojtěch Krejsa, the threat researcher at Gen who discovered the malware, describes the VoidStealer bypass as non-obtrusive.

“The bypass requires neither elevation of privilege nor code injection, making it a more discreet approach compared to other ABE bypass methods,” he said in a blog post.

See also: Magento: PolyShell vulnerability allows RCE and account theft

VoidStealer: Theft of the master key

An ABE bypass revolves around a critical piece of hardware, the “v20_master-key.” It’s this key that ultimately unlocks the browser’s stored secrets, including cookies, passwords , and tokens, once the browser verifies the request.

In theory, ABE keeps this key well-protected, ensuring that it is not exposed in a way that malware can easily obtain. However, in practice, this key must be present in plaintext during execution, even briefly, for Chrome to do its job. Previous circumvention techniques have found ways to circumvent decryption, some relying on process injection that involved injecting malicious code into Chrome to call a legitimate decryption routine.

Others used memory dumping or  remote debugging, scanning large chunks of process memory to locate decrypted data. More advanced approaches abused Chrome's elevation service or COM interfaces to trick the browser into handing over decrypted material.

VoidStealer takes a more precise approach, according to Krejsa. Instead of forcing Chrome to decrypt data or perform memory scraping, it attaches as a debugger and waits. By placing hardware breakpoints at a precise command that is connected to Chrome's decryption flow, it intervenes the moment the v20_master_key appears in plain text in memory.

See also: Quest KACE SMA: Hackers exploit critical vulnerability

It then reads the key using standard debugging APIs. VoidStealer uses hardware breakpoints because they do not modify the code. Unlike software breakpoints, which can be detected, hardware breakpoints rely on CPU registers, leaving memory untouched. At the same time, they do not change the physical execution of Chrome.

Malware with multiple techniques

VoidStealer is part of a broader shift in how infostealers have evolved since ABE. The malware already supports multiple circumvention techniques, falling back to older injection-based methods when necessary. However, it certainly prioritizes stealthwhen possible.

Krejsa also warned about its growth rate. Since its initial appearance in December 2025, the malware has evolved rapidly, suggesting active maintenance and potential demand from customers in underground markets. The malware, which operates on a MaaS model, has a total of 12 versions so far, with the latest version “v2.1” released on March 18, 2026. Because VoidStealer avoids injection and privilege elevation, traditional indicators may be inadequate.

See also: Trivy Security Scanner GitHub Actions Breach

Defenders should focus on behavioral signals, including unexpected debugger attachments to browser processes, unusual use of memory-reading APIs, and anomalous Chrome process spawning patterns.

As the primary breach indicator (IoC), the researcher shared a sample linked to VoidStealer v2.0.