Padding Oracle Vulnerability in Google Chrome's AppBound Encryption Mechanism

CVE-2025-34091

What is CVE-2025-34091?

A vulnerability in Google Chrome’s AppBound cookie encryption allows local attackers to exploit observable decryption failure behavior. By sending malformed ciphertexts to the Chrome elevation service, attackers can determine padding and MAC errors, leading to a padding oracle attack. This vulnerability compromises the integrity of the AppBound Encryption, facilitating low-privileged cookie theft. The issue stems from interactions between Chrome’s implementation and Windows DPAPI's logging of decryption errors, enabling the recovery of sensitive cookie keys. Other Chromium-based browsers may also be at risk if they utilize similar encryption mechanisms.

References