Security Researchers Afraid to Reveal Vulnerabilities

DumpBrowserSecrets is a precompiled Windows post‑exploitation tool that harvests browser-stored credentials and session tokens from Chrome, Edge, Brave (App-Bound Encryption), Opera/Opera GX/Vivaldi (DPAPI), and Firefox (NSS). It bypasses Chrome's App-Bound Encryption by spawning a headless Chromium process and injecting a DLL via Early Bird APC to use the IElevator COM interface to decrypt the app_bound_encrypted_key, then parses on-disk SQLite/JSON stores to extract cookies, saved logins, OAuth refresh tokens, credit cards, autofill data, history, and bookmarks into structured JSON; the tool includes multiple operational evasion features and the report outlines attack scenarios, detection opportunities, and mitigations.