# PEEP Exploits Chrome and Edge for Post-Compromise Command Execution A Chromium-based toolkit bypasses security checks to execute host-level commands. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-09-07 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/092b0815-d0cc-47ef-afb5-5d975018b6b6 ## Introduction to PEEP Cybersecurity researchers have uncovered PEEP, a Chromium-based post-exploitation toolkit disguised as a bookmark extension. It requires prior administrative access to inject itself into Chrome and Edge profiles, bypassing Web Store checks and user prompts by forging Chromium's Secure Preferences integrity values. This allows it to execute host-level commands and manage files. ## Functionality of PEEP Once installed, PEEP polls its command-and-control server every 30 seconds over plaintext HTTP. It exfiltrates browsing history, active-tab metadata, and session cookies. Additionally, it functions as a remote access toolkit, enabling host command execution, credential theft, session hijacking, and web page alteration. ## Technical Foundations PEEP is built on RedExt, an open-source browser data analysis and red teaming framework previously used in GlassWorm attacks. It expands on RedExt with dedicated installation routines, a native host bridge, heartbeat telemetry, and an update channel. This makes PEEP a derivative of RedExt, enhancing its capabilities. ## Installation and Persistence PEEP masquerades as 'Smart Bookmarks' and injects itself directly into browser profiles. It maintains persistence through sideloading, enterprise force-install policies, preference-integrity manipulation, and a ScriptCache fallback. This ensures the extension remains active even after browser restarts. ## Command Execution PEEP uses a native-messaging tool to extend its functionality beyond browser telemetry. It invokes an auxiliary executable for operating system access and runs browser-based commands locally. This transforms the malware from a credential stealer to a full remote-access tool. ## Targeting Linux Environments The presence of a Python script, 'patch_secure_prefs_linux.py,' indicates that the threat actor is replicating PEEP's behavior to target Linux environments. This suggests a broader scope of operation beyond Windows-based systems. ## Attribution and Impact The activity remains unattributed, but Chinese-language artifacts in the source code point to a Chinese-speaking threat actor. PEEP builds on existing host compromises, using Chrome/Edge as a persistent backdoor to bypass detection and execute commands. ## Security Implications PEEP's ability to bypass Web Store checks and manipulate browser preferences highlights significant security vulnerabilities. Its persistence mechanisms and host-level command execution pose a serious threat to endpoint security, emphasizing the need for robust detection and mitigation strategies. ## Sources covering this story - https://thehackernews.com/2026/09/peep-turns-chrome-and-edge-into-post.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._