PEEP Turns Chrome/Edge Into Post‑Compromise Backdoors

Cybersecurity researchers have disclosed details of a complex Chromium-based post‑exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser. It requires prior administrative or code execution access; its installer injects the extension directly into Chrome and Microsoft Edge profiles while forging Chromium’s own Secure Preferences entries.¹

The attacker runs the installer once they possess elevated rights, inserting a bookmarks extension directly into user profiles on Google Chrome and Microsoft Edge without triggering normal browser security flows. By manipulating these preference files—trusted by the engine because signed and stored securely—PEEP can load malicious DLLs or scripts without invoking sandboxed extension permissions that would otherwise flag suspicious behavior.¹

Security specialists note this technique exploits a feature designed to store browser data securely rather than to execute third‑party code. Similar tactics were observed in 2018 with the “Duropwn” exploit against Samsung devices, which leveraged firmware flaws to install malware onto hardware; however Duropwn required an earlier compromise and was limited compared to zero‑day attacks that could achieve comparable results from scratch. In contrast, PEEP only needs administrative or code execution privileges already present after a breach, making it highly effective once initial foothold is achieved.¹

PEEP also hides its presence within existing browser structures such as bookmarks, taking advantage of user habits that rarely scrutinize extensions beyond their declared purpose. This camouflage reduces detection risk even when typical extension sandboxes are active, though enterprise networks with stricter policy enforcement may still catch anomalous preference changes if monitoring tools scan for unauthorized modifications. The toolkit’s reliance on Secure Preferences means standard anti‑malware scanners focusing solely on executable binaries might miss it entirely, underscoring the need for holistic security postures that include configuration integrity checks.¹

From an operational standpoint, discovery highlights how attackers blend social engineering—by presenting benign-looking extensions—with low-level system manipulation to maintain persistence. Analysts advise users to verify any new extensions against official Web Store listings, avoid granting unnecessary permissions, and keep browsers updated so newer Chromium releases contain mitigations against preference tampering.¹

The emergence demonstrates well-protected platforms can be subverted by insiders or attackers who have already bypassed initial defenses.