There are rumors circulating about a recent Google Chrome flaw that lets hackers obtain login tokens that are saved in the browser.

There are rumors circulating about a recent Google Chrome flaw that lets hackers obtain login tokens that are saved in the browser.

According to reports, a new security hole in Google Chrome is caused by malware that is installed on desktop PCs and then extracts and decrypts login tokens that are kept in the local database of the browser.

Subsequently, Chrome utilizes the hijacked tokens to initiate requests to a Google API, which is normally used to synchronize accounts across all Google services.

This method will result in the creation of persistent Google cookies, which will facilitate unauthorized users' access to user accounts.

This vulnerability is distinct since it can get around two-factor authentication. Even when the user changes the password, it may still be able to access the system. This is made feasible by the attack's use of restore file key infusion, which permits cookie reauthorization even after a password change.

The attack is concerning because of that restoration process, which allows the attacker to keep compromising the account without the user's knowledge.

However, because it was initially observed in November, this isn't very new. Six malware gangs are allegedly in possession of it and actively trading the vulnerability. A few vendors claim to have modified their attack to evade Google's security protocols.

Sadly, there isn't a recognized method to fend off the assault.