VUPEN Whitehats Claim To Have Broken Chrome Sandbox

DumpBrowserSecrets is a publicly documented post‑exploitation tool that harvests browser‑stored credentials (passwords, session cookies, OAuth tokens, credit cards, autofill data, history, bookmarks) from Chromium‑based and Firefox browsers. It bypasses Chrome’s App‑Bound Encryption by spawning a headless Chromium process and injecting a DLL to use the IElevator COM interface to decrypt keys, employs evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, handle duplication), outputs structured JSON, and is presented as a red‑team utility for assessing credential exposure and detection efficacy.