Side-Channel Attack Recovers Chrome’s AppBound Cookie Encryption Key

Disclosure: I work at CyberArk and worked on this research.

We reversed Chrome’s AppBound cookie protection by measuring subtle timing differences during WebView lifecycle transitions. The result: full decryption of protected cookies in enterprise-managed profiles. No sandbox escape, no root, just timing.