NSA Together With Mitre CWE and SANS Identifies Top 25 Programming Errors

DumpBrowserSecrets is a publicly documented post‑exploitation tool that harvests browser‑stored credentials (passwords, cookies, OAuth refresh tokens, credit card data, autofill and history) from major Chromium and Gecko browsers on Windows. It implements a technical bypass for Chrome's App‑Bound Encryption by injecting a DLL into a headless Chromium process to use the IElevator COM interface, supports DPAPI and NSS decryption for other browsers, includes multiple operational evasion features to reduce EDR detection, and is distributed as precompiled binaries for red‑team and adversary use; the report also describes detection signals and mitigations.