Disclosure: I work at CyberArk
AppBound is a Chrome feature designed specifically for enterprise environments. It encrypts cookies and ties them to a verified app identity, aiming to restrict access and prevent tampering, even across apps on the same device. It’s meant to serve as a critical security boundary for managed Chrome sessions, especially in corporate use cases.
The research shows that this boundary can be broken. The flaw lies in the key derivation process, which uses predictable inputs and insufficient entropy. This allows an attacker to recover the encryption key without elevated privileges, effectively bypassing the protections AppBound is intended to provide.
The impact: Once the key is extracted, sensitive session cookies can be decrypted and stolen. For enterprises, this opens the door to unauthorized access to corporate apps, account takeovers, and large-scale data breaches.
https://www.cyberark.com/resources/threat-research-blog/c4-bomb-blowing-up-chromes-appbound-cookie-encryption