The toolkit is not a foothold itself—it demands pre-existing administrative privileges or code execution on the target host. Once that access is secured, its installer sidesteps the normal Web Store review process and any user consent prompts by injecting the extension directly into browser profiles. What makes this particularly nasty is how it forges Chromium’s own Secure Preferences file, effectively tricking the browser into treating the malicious add-on as both trusted and user-approved.

That means PEEP can survive browser restarts and operate quietly under the radar, giving attackers a reliable channel to issue commands on the compromised machine through the browser itself.

Key technical takeaways:

• PEEP requires prior administrative or code execution access—it is not a remote code execution exploit.
• It targets Chrome and Edge by modifying profile directories directly.
• The installation bypasses Web Store checks and user prompts by forging Secure Preferences.
• The extension’s purpose is post-compromise persistence and host-level command execution.

This isn’t a vulnerability in the browsers themselves—it’s an abuse of trust mechanisms that assumes the attacker already owns the box. Defenders should focus on monitoring abnormal modifications to browser profile directories and auditing extensions that appear without a corresponding Web Store installation event.

Source: The Hacker News

Has your organization taken steps to audit browser profiles for unauthorized extension injections, or do you rely on endpoint detection alone to catch this kind of post-exploitation movement?