PT-2025-27672 · Google · Google Chrome

Ari Novick · Published 2025-07-02 · Updated 2025-07-02 · CVE-2025-34091

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions: Google Chrome (affected versions not specified)

Description: A padding oracle vulnerability exists in Google Chrome's AppBound cookie encryption mechanism. This issue arises due to observable decryption failure behavior in Windows Event Logs when handling malformed ciphertext in SYSTEM-DPAPI-encrypted blobs. A local attacker can repeatedly send malformed ciphertexts to the Chrome elevation service and distinguish between padding and MAC errors, enabling a padding oracle attack. This allows partial decryption of the SYSTEM-DPAPI layer and eventual recovery of the user-DPAPI encrypted cookie key. The vulnerability undermines the core purpose of AppBound Encryption by enabling low-privileged cookie theft through cryptographic misuse and verbose error feedback.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Generation of Error Message Containing Sensitive Information

Side Channel Attack

Weakness Enumeration

CWE-209

CWE-203

Related Identifiers

BDU:2025-09940

CVE-2025-34091

Affected Products

Google Chrome

References · 8

• https://cve.org/CVERecord?id=CVE-2025-34091 · Security Note
• https://bdu.fstec.ru/vul/2025-09940 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-34091 · Security Note
• https://twitter.com/xvonfers/status/1940505749073154086 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1940529873325293650 · Twitter Post
• https://twitter.com/CVEnew/status/1940495176817848828 · Twitter Post
• https://cyberark.com/resources/threat-research-blog/c4-bomb-blowing-up-chromes-appbound-cookie-encryption · Note
• https://vulncheck.com/advisories/google-chrome-appbound-cookie-encryption · Note