They introduced a COM-based gatekeeper, usually an elevation_service.exe, that's supposed to ensure only the real browser gets to decrypt the master app_bound_key. My own ...