Chrome Sync Feature Misused to Harvest Millions of Saved Passwords, Exposing Users to Credential Theft
What Happened — Researchers discovered that a malicious actor was able to hijack Google Chrome’s sync service, extracting saved passwords, cookies, and autofill data from synced profiles. The stolen data spanned millions of accounts, enabling credential‑stuffing attacks against a variety of online services.
Why It Matters for Compliance & Audit Readiness
- Demonstrates a failure to enforce robust access‑control safeguards around privileged sync tokens – a core SOC 2 CC6.1 control.
- Highlights the need for continuous monitoring of credential‑use anomalies to provide defensible audit evidence of “least‑privilege” enforcement.
- Aligns directly with Verisq’s SOC 2 Access Controls capability, which automates token‑usage logging and policy compliance checks.
Who Is Affected – Consumer‑facing web services, SaaS platforms, and any organization that relies on Chrome sync for employee or customer authentication data.
Recommended Actions
- Enforce MFA for all accounts that can enable Chrome sync and rotate any exposed credentials immediately.
- Update internal policies to restrict sync usage on corporate devices and log all sync token activity.
- Deploy continuous credential‑access monitoring to detect anomalous extraction patterns and retain evidence for SOC 2 audits.
Source: The Hacker News – ThreatsDay roundup
Technical Notes
- Attack Vector: Abuse of Chrome’s sync API via stolen OAuth refresh tokens; no CVE was involved, but the misuse of default sync settings enabled the breach.
- Data Types Exfiltrated: Saved passwords, cookies, autofill form data, and browsing history.
- Impact: Credential theft leading to downstream account compromise across multiple services.