xaitax/Chrome-App-Bound-Encryption-Decryption

Health v2 · maintenance only

Adoption not part of the score

1762 stars · 297 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Windows post-exploitation research tool that bypasses Chromium's App-Bound Encryption using direct syscall-based reflective process hollowing to decrypt browser data in memory. It extracts cookies, passwords, payment methods, and tokens from Chrome, Edge, Brave, and Avast without admin rights or disk writes.

Use cases

• decrypt chrome app-bound encryption cookies
• extract saved passwords from chromium browsers
• bypass app-bound encryption on windows
• red team tool for browser credential extraction
• demonstrate process hollowing with direct syscalls
• retrieve payment card data from chrome profiles
• fileless in-memory browser data decryption
• security research on chromium ABE COM server

When to choose

• you are an authorized red teamer or pentester demonstrating browser credential theft on Windows
• you research Chromium's App-Bound Encryption internals and COM-based security model
• you need a fileless, user-mode proof of concept that evades user-land API hooks

When to avoid

• you want to recover your own lost browser passwords through legitimate means
• you need a cross-platform or defensive/analysis tool rather than an offensive exploit
• your environment or jurisdiction prohibits use of credential-extraction tooling

Facets

cli-tool · maturity active

security penetration-testing reverse-engineering cryptography cli security penetration-testing reverse-engineering windows privacy windows cli app-bound-encryption chromium process-hollowing direct-syscalls reflective-dll-injection credential-extraction post-exploitation edr-evasion fileless-malware red-team

Member repositories

For agents

markdown · JSON · MCP: product_card(name="xaitax/Chrome-App-Bound-Encryption-Decryption")