Serious Vulnerability In Adobe ColdFusion Application Server

DumpBrowserSecrets is a precompiled Windows post‑exploitation tool that harvests browser‑stored secrets (saved credentials, session cookies, OAuth refresh tokens, credit cards, autofill data, history, and bookmarks) across major Chromium‑based and Firefox browsers. It bypasses Chrome’s App‑Bound Encryption by spawning a headless Chromium process and injecting a DLL to call the IElevator COM interface, retrieves DPAPI or NSS keys for other browsers, and includes evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, handle duplication). The report includes usage, an attack scenario demonstrating rapid credential extraction for lateral movement or cloud account takeover, and detection/mitigation guidance.