Uber’s Secret Management Platform – Scaling Secrets Security Across Multi-Cloud

DumpBrowserSecrets is a red-team post-exploitation tool that harvests browser-stored secrets (saved logins, session cookies, OAuth refresh tokens, credit cards, autofill data, history, bookmarks) from Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox on Windows. It bypasses Chrome's App-Bound Encryption by spawning a headless Chromium process and injecting a DLL to call the IElevator COM interface (Early Bird APC injection), handles DPAPI and NSS decryption for other browsers, and includes operational evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, handle duplication). The report covers functionality, usage examples, attack scenarios, detection opportunities, and mitigations aimed at assessing and hardening enterprise endpoints against browser credential theft.