moonD4rk/HackBrowserData · warning

%q: %w

Error message

%q: %w

What it means

The D-Bus tier completed its full scan of all collections and items without finding a secret whose label equals the requested Chromium storage name. This is errStorageNotFound wrapped with the storage label — the keyring simply contains no item named e.g. 'Chromium Safe Storage'.

Source

Thrown at masterkey/retriever_linux.go:69

		}
		for _, item := range items {
			label, err := item.GetLabel()
			if err != nil {
				continue
			}
			if label == storage {
				secret, err := item.GetSecret(session.Path())
				if err != nil {
					return nil, fmt.Errorf("get secret for %s: %w", storage, err)
				}
				if len(secret.Value) > 0 {
					return linuxParams.deriveKey(secret.Value), nil
				}
			}
		}
	}

	return nil, fmt.Errorf("%q: %w", storage, errStorageNotFound)
}

// PosixRetriever derives Chromium's kV10Key via PBKDF2 over the hardcoded "peanuts" password — the
// deterministic v10 key used when no keyring exists (headless/Docker/CI). Mirrors PosixKeyProvider.
type PosixRetriever struct{}

func (r *PosixRetriever) RetrieveKey(_ Hints) ([]byte, error) {
	return linuxParams.deriveKey([]byte("peanuts")), nil
}

// DefaultRetrievers wires the Linux tiers, one per prefix Chromium emits: v10 = PBKDF2("peanuts")
// (kV10Key, no keyring); v11 = PBKDF2(keyring secret) (kV11Key, via D-Bus). A profile can carry both
// if the host moved between headless and keyring sessions, so both run independently.
func DefaultRetrievers() Retrievers {
	return Retrievers{
		V10: &PosixRetriever{},
		V11: &DBusRetriever{},
	}

View on GitHub (pinned to 0503d04d7a)

Solutions

1. Confirm the entry exists and its exact label: secret-tool search --all xdg:schema chrome_libsecret_org_chromium_libsecret 'Chromium Safe Storage'
2. Launch the browser once in a GUI session so it creates the Safe Storage item, then retry
3. Use the v10 fallback — Linux DefaultRetrievers already includes PosixRetriever, whose PBKDF2("peanuts") key decrypts v10 cookies from keyring-less profiles
4. Check for a renamed/forked browser whose storage label differs from the hinted KeychainLabel

labels, _ := exec.Command("secret-tool", "search", "--all",
    "xdg:schema", "chrome_libsecret_org_chromium_libsecret",
    "Chromium Safe Storage").Output()
if len(bytes.TrimSpace(labels)) == 0 {
    // no matching keyring item — skip DBusRetriever, use v10 key
}

key, err := dbusRetriever.RetrieveKey(hints)
if errors.Is(err, errStorageNotFound) || strings.HasSuffix(err.Error(), "not found") {
    key, _ = posixRetriever.RetrieveKey(hints) // v10 PBKDF2("peanuts")
}

When it happens

Trigger: RetrieveKey iterates every collection/item; no item label matches hints.KeychainLabel exactly (case-sensitive), so it returns the not-found sentinel.

Common situations: The browser never ran under a desktop session so it never created a Safe Storage entry (headless/Docker profiles are v10-only); the keyring was reset; the browser stores its secret under a different label than expected; a new/renamed Chromium fork.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

Related errors

• not found in credential store
• dbus session: %w
• get collections: %w
• ciphertext too short
• ciphertext is not a multiple of the block size

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/ecf884a2cf54149f. Report an issue: GitHub.