Chocolate Owns Your Passwords

DumpBrowserSecrets is a publicly available post-exploitation tool that harvests credentials and session tokens from major browsers (Chrome, Edge, Brave, Opera, Opera GX, Vivaldi, and Firefox). It bypasses Chrome's App‑Bound Encryption by spawning a headless Chromium process and injecting a DLL to use the IElevator COM interface, extracts DPAPI and NSS‑protected secrets where applicable, includes operational evasion (string obfuscation, API hashing, PPID/argument spoofing, file-handle duplication), outputs structured JSON, and is intended for red‑team assumed‑breach testing while also representing a high-risk capability if used by malicious actors.