Researcher Uncovers XSS Flaws In Twitter and Google Calendar

DumpBrowserSecrets is a post-exploitation credential-harvesting tool that extracts saved passwords, session cookies, OAuth refresh tokens, credit card data, autofill entries, and browsing history from major Chromium-based and Firefox browsers by using DLL injection into a headless Chromium process to bypass App-Bound Encryption (via the IElevator COM interface) and by retrieving DPAPI/NSS keys for other browsers; the report covers architecture, evasion techniques, usage, detection opportunities, and red-team use cases.