Local r00t Exploit ( BID 18874 / CVE-2006-2451 )

DumpBrowserSecrets is a precompiled Windows post-exploitation tool that harvests browser-stored credentials and session tokens from major Chromium-based browsers and Firefox. It bypasses Chrome's App-Bound Encryption (Chrome 127+) by spawning a headless Chromium process, injecting a DLL via Early Bird APC, and calling the IElevator COM interface to decrypt encryption keys, then parses and decrypts on-disk browser databases to output saved passwords, cookies, OAuth refresh tokens, credit cards and history as JSON. The tool includes operational evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, custom SQLite parser) and is intended for red-team assumed-breach assessments but represents a high-risk capability if used by adversaries.