Vidar Chrome ABE Bypass: Browser Forked with --no-first-run --disable-gpu about:blank

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects instances of Chrome, Edge, or Brave browsers being launched with specific command-line arguments ('--no-first-run', '--disable-gpu', 'about:blank') by a non-browser parent process. This technique is commonly used by Vidar Stealer to create a child browser process that is vulnerable to memory injection or diagnostic manipulation, allowing the attacker to bypass Chrome Application-Bound Encryption (ABE) and extract master keys.