Chromium Browser Credential DB Access by Non-Browser Process (T1555.003)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•1

Detects instances where processes other than legitimate browser-related binaries access sensitive SQLite database files (Login Data and Cookies) associated with Google Chrome or Microsoft Edge. This activity is a common indicator of credential theft by malicious tools or scripts attempting to extract stored passwords or session cookies.