Google downplays reports of malware abusing an undocumented Chrome API to generate new authentication cookies, saying such token theft attacks “are not new”
Google is downplaying reports of malware abusing an undocumented Google Chrome API to generate new authentication cookies when previously stolen ones have expired.
Context & Ripple Effects
The report follows researchers’ account that abuse of Google’s MultiLogin OAuth endpoint could restore expired authentication cookies, allowing account access to persist even after a password reset. Google’s response frames the newly reported Chrome API path as part of that established token-theft problem rather than a newly discovered attack class.
It also sits alongside Google’s earlier patch for GhostToken, an OAuth-based account-backdooring flaw, underscoring that browser and identity-layer security can intersect when attackers obtain durable account-session artifacts.
First-order effects
- Google has not characterized the reported Chrome API abuse as a novel vulnerability, so the immediate story is a clarification of threat framing rather than an announced product fix.
- Users and defenders must treat stolen authentication cookies as an account-persistence risk: resetting a password alone may not invalidate an attacker’s ability to regain a session when token-restoration paths are available.
Second-order effects
- Security teams will need to emphasize detection and revocation of compromised sessions and tokens alongside credential resets, particularly for accounts exposed to infostealer malware.
- The report puts additional scrutiny on the boundary between Chrome’s undocumented interfaces and Google’s OAuth/session controls, even if Google considers the underlying technique longstanding.
Third-order effects
- If token theft continues to outlast conventional credential resets, account recovery will increasingly depend on identity systems that can distinguish legitimate session renewal from attacker-driven restoration.
- The broader security model shifts from protecting passwords alone toward managing the lifecycle, provenance, and revocation of browser-held authentication tokens.
The trend: This is one data point in the move from password-centric account defense to session- and token-centric identity security.