Windows Binary Planting DLL Preloading/Hijacking Bug

DumpBrowserSecrets is a public post-exploitation tool that harvests browser-stored credentials and session data from major Chromium-based browsers and Firefox. It bypasses Chrome's App‑Bound Encryption by launching a headless Chromium instance and injecting a DLL via Early Bird APC to call the IElevator COM interface and decrypt the app_bound_encrypted_key, then parses and decrypts on-disk SQLite/JSON stores to produce structured JSON output containing cookies, OAuth refresh tokens, saved logins, autofill data and more — enabling rapid lateral movement or cloud account takeover. The report includes operational evasion techniques, usage examples, detection opportunities, and mitigation recommendations.