[Python] Chrome Cookie Decryption Fails: What Am I Missing?

I'm trying to decrypt Chrome cookies from the Cookies SQLite database using Python. I extract the AES master key from the Local State file, then try to decrypt the cookie values using AES-GCM (for v10, v11 or v20 cookies) or DPAPI for older formats.

However, all of my decryption attempts fail (I get errors or junk data).

from Crypto.Cipher import AES
import win32crypt

def get_browser_master_key(base_path):
local_state_path = os.path.join(base_path, "Local State")
with open(local_state_path, "r", encoding="utf-8") as f:
local_state = json.load(f)
encrypted_key = base64.b64decode(local_state["os_crypt"]["encrypted_key"])[5:]
master_key = win32crypt.CryptUnprotectData(encrypted_key, None, None, None, 0)[1]
return master_key

def silent_decrypt(buff, key):
try:
if buff[:3] in [b'v10', b'v11', b'v20']:
iv = buff[3:15]
payload = buff[15:-16]
tag = buff[-16:]
cipher = AES.new(key, AES.MODE_GCM, nonce=iv)
decrypted = cipher.decrypt_and_verify(payload, tag)
return decrypted.decode("utf-8")
else:
return win32crypt.CryptUnprotectData(buff, None, None, None, 0)[1].decode("utf-8")
except Exception as e:
return f"[FAILED] {str(e)}"


Why does this not decrypt my Chrome cookies correctly? Am I handling the AES-GCM format right? Is there any recent change in Chrome I should be aware of? Any ideas for how to fix my decryption logic to get the real plaintext cookie value?

Continue reading...