Google Fixes Serious Vulnerability in Gmail

DumpBrowserSecrets is a post-exploitation credential-harvesting tool that targets major Windows browsers (Chrome, Edge, Brave, Opera variants, Vivaldi, Firefox) to extract saved passwords, session cookies, OAuth refresh tokens, credit card data, autofill entries, history and bookmarks. It bypasses App-Bound Encryption (via spawning a headless Chromium process and injecting a DLL using Early Bird APC to call the IElevator COM interface), retrieves DPAPI and NSS-protected secrets where applicable, and includes operational evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, file-handle duplication, and a custom SQLite parser). The tool outputs structured JSON, is positioned for red-team/assumed-breach use, and the report discusses attack scenarios, detection opportunities (unexpected process injection, IElevator calls, headless browser instantiation, reads of browser SQLite files), and mitigations such as using external credential managers and EDR rules that monitor the IElevator interface and headless browser behavior.