Serious Java Bug Exposes Users To Code Execution

DumpBrowserSecrets is a public post-exploitation tool that harvests saved credentials, session cookies, OAuth tokens, credit card data, autofill entries and browsing history from major browsers (Chrome, Edge, Brave, Opera family, Vivaldi, and Firefox). It bypasses Chrome's App-Bound Encryption by injecting a DLL into a headless Chromium process and using the IElevator COM interface, handles DPAPI and NSS-encrypted stores, and includes evasion features like string obfuscation, API hashing, PPID/argument spoofing, and custom SQLite parsing; the report also provides attack scenarios, detection opportunities, and mitigation recommendations.