Microsoft Rushes Out ‘Fix It’ For Internet Explorer 0-day Exploit

DumpBrowserSecrets is a publicly documented post-exploitation tool that harvests browser-stored credentials and session tokens from major browsers (Chrome, Edge, Brave, Opera family, Vivaldi, Firefox). It bypasses Chrome's App-Bound Encryption by spawning a headless Chromium process and injecting a DLL to use the IElevator COM interface, retrieves DPAPI or NSS secrets for other browsers, and includes operational evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication). The tool outputs structured JSON suitable for red-team use but also presents a high-risk capability for lateral movement and cloud account takeover if used by adversaries.