Firmware Security Analysis Tool

DumpBrowserSecrets is a publicly documented post‑exploitation tool that harvests credentials and session data from major Windows browsers (Chrome, Edge, Brave, Opera family, Vivaldi, Firefox). It bypasses App‑Bound Encryption (Chrome 127+) by spawning a headless Chromium process and injecting a DLL to use the IElevator COM interface to decrypt the app_bound_encrypted_key, uses DPAPI/NSS handling for other browsers, and extracts cookies, saved logins, OAuth refresh tokens, credit cards, autofill, and history into JSON. The report details operational evasion features (string obfuscation, API hashing, PPID/argument spoofing, Early Bird APC injection, custom SQLite parser), highlights fast actionable impact for lateral movement and cloud account takeover, and provides detection and mitigation advice focused on monitoring IElevator calls, unexpected process injection, headless browser instantiation, and protecting credentials outside the browser.