How does Chrome block all methods of code injection past version 78? It even blocks signed DLLs it doesn't have in a static list.


This is caused by a number of Windows exploit mitigation features, most notably Code Integrity Guard (CIG) and image load policies.

You can see this in effect using Process Hacker's mitigation policies view:

Screenshot of mitigation policies for Chrome process

The "Images restricted" mitigation is preventing any images (executable modules, like DLLs) being loaded into the process if they are from remote sources (e.g. SMB shares) or if they are marked as low integrity.

The "Singatures restricted" mitigation is Code Integrity Guard (CIG). This prevents an images being loaded that are not signed by Microsoft, excluding modules that are directly imported by the main executable's import table. This prevents DLL injection of anything that isn't signed by Microsoft.

Control Flow Guard (CFG) also causes API calls to validate the call stack against a known-good list of caller addresses, which breaks many injection techniques.

The default system policy may also apply EAF, IAF, EAF+, and IAF+ mitigations, which prevent injected code from scanning the import and export tables of loaded modules to manually resolve API addresses.

It is also likely that Arbitrary Code Guard is enabled on a per-thread or per-process basis elsewhere within Chrome, which prevents RWX memory pages from being created by all but opt-out threads, and makes executable pages loaded from signed modules immutable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.