Say I have a "Login Data" Chrome file that is encrypted with the user's Windows password. Is there a way I can brute-force the file and try to decrypt it using every password possible?
Since chrome v80, chrome encrypts cookies and passwords using AES256-GCM with a randomly generated key. The key used for encryption is then encrypted with DPAPI and stored in the 'Local State' file in the user's chrome profile. However, the DPAPI is used in
Local_Machine scope which means that any user on the computer where the encryption was done can decrypt the data (i.e. encryption does not rely on user's password at all). I am not sure exactly how the master key for encryption on Local_Machine is derived, but if I remember correctly, it uses environment specific variables.
What this means is that if you only have the "Login Data" file available, you will have to brute-force the 256 bit AES key, which is currently practically impossible. Even if you can get your hands on the user's "Local State" file you will still not be able to decrypt the key unless you can figure out and obtain all the environment specific variables DPAPI relies on. Your best bet would be to gain physical access to the system while any user is logged on and then decrypt the passwords using something like ChromePass