CVE-2026-84325

A flaw was found in chromium-browser. This improper input validation vulnerability in the DataTransfer component allows a remote attacker, through social engineering, to bypass system access restrictions by leveraging a co-installed application. This could lead to unauthorized access to sensitive...

chlonium

Chlonium Chlonium is an application designed for cloning Chromium Cookies. From Chromium 80 and upwards, cookies are encrypted using AES-256 GCM, with a state key which is stored in the Local State file. This state key is encrypted using DPAPI. This is a change from older versions, which used DPA...

fortress

One browser engine to rule them all Stealth Chromium engine...

XSS-Scanner

XSS Scanner Cross-Site Scripting XSS is one of the most well known web application vulnerabilities. It even has a dedicated chapter in the OWASP Top 10 project and it is a highly chased vulnerability in bug bounty programs. The scanner gets a link from the user and scan the website for XSS...

EyeWitness

EyeWitness - Web Screenshot Tool EyeWitness is designed to take screenshots of websites, provide server header info, and identify default credentials if known. Now powered by Chromium browser for better reliability and easier installation. 🚀 Key Features Cross-platform support - Windows, Linux,...

cve-2025-4664

CVE-2025-4664 This repository contains a PoC for exploiting CVE-2025-4664, a vulnerability where Chromium-based browsers leak sensitive URL parameters through Link header preload requests. Resources For a detailed explanation of how this exploit works, read the blog post:...

CVE-2025-2783

Chromium CVE-2025-2783: Sandbox Escape & Full-Chain RCE Exploit This repository contains a full-chain exploit implementation for CVE-2025-2783. The vulnerability resides in Chromium's Ipcz communication layer, allowing an attacker to achieve sandbox escape and arbitrary code execution from a...

posta

Posta Posta is a tool for researching Cross-document Messaging communication. It allows you to track, explore and exploit postMessage vulnerabilities, and includes features such as replaying messages sent between windows within any attached browser. Prerequisites Google Chrome / Chromium Node.js...

noapi-google-search-mcp

noapi-google-search-mcp [email protected] If you want to support noapi-google-mcp or gpt-oss-20B/120B-Vision and other open source models in the pipeline please add to my GPU compute fund: around $3000 are needed. If you find this useful, consider supporting continued development and new...

SharpChromium

SharpChromium Introduction SharpChromium is a .NET 4.0+ CLR project to retrieve data from Google Chrome, Microsoft Edge, and Microsoft Edge Beta. Currently, it can extract: Cookies in JSON format History with associated cookies for each history item Saved Logins Note: All cookies returned are in...

scrying

NCC Group Scrying A new tool for collecting RDP, web and VNC screenshots all in one place This tool is still a work-in-progress and should be mostly usable but is not yet complete. Please file any bugs or feature requests as GitHub issues Motivation Since Eyewitness recently dropped support for R...

Adamantium-Thief

🔓 Adamantium-Thief Get chromium based browsers: passwords, credit cards, history, cookies, bookmarks, autofill. Chrome 80 is supported! Need firefox passwords decryptor? 🌿 Examples: 🔑 Get passwords from browsers: root@kitploit: Stealer.exe PASSWORDS 💳 Get credit cards from browsers: root@kitploit...

Chrome-App-Bound-Encryption-Decryption

ChromElevator Chrome App-Bound Encryption Decryption 🚀 Overview A post-exploitation tool demonstrating a complete, in-memory bypass of Chromium's App-Bound Encryption ABE. This project utilizes Direct Syscall-based Reflective Process Hollowing to launch a legitimate browser process in a suspended...

CVE-2024-6778-POC

CVE-2024-5836 / CVE-2024-6778 This repository contains proof of concept exploits for CVE-2024-5836 and CVE-2024-6778, which are vulnerabilities within the Chromium web browser which allowed for a sandbox escape from a browser extension. To run these, you must be on a version of Chromium older tha...

EvilSelenium

EvilSelenium EvilSelenium is a new project that weaponizes Selenium to abuse Chromium-based browsers. The current features right now are: Steal stored credentials via autofill Steal cookies Take screenshots of websites Dump Gmail/O365 emails Dump WhatsApp messages Download & exfiltrate files Add...

fortress

Un motor de navegador para gobernarlos a todos Motor Chromium sigiloso...

webscreenshot

webscreenshot Descripción Un script sencillo para capturar pantallas de una lista de sitios web, basado en el script url-to-image de PhantomJS. Características Integración del 'renderizado diferido' de url-to-image para recursos AJAX Funciona completamente en sistemas Windows y Linux Soporte de...

extloader

extLoader A small toolkit for managing and deploying unpacked Chromium extensions. Find out more in the following blogpost: https://www.synacktiv.com/en/publications/the-phantom-extension-backdooring-chrome-through-uncharted-pathways Installation Direct install pipx root@kitploit: pipx install...

V8Harvest

V8Harvest V8Harvest helps view recent V8 bug patterns on a single page for analyzing V8 vulnerabilities. It has parsed all regress- files under the directory of src/v8/test/mjsunit/ using git log. Each regress contains the following links related to its own information: Chromium Bugs / V8 Bugs V8...

Microsoft-Edge-Information-Disclosure

Microsoft-Edge-Information-Disclosure CVE-2024-30056 Microsoft Edge Chromium-based Information Disclosure Vulnerability This is a vulnerability in Microsoft Edge Chromium-based. The attacker was able to trick the user into revealing sensitive information without his knowledge. Poc: root@kitploit:...