CDP-Enable-BOF and CDP-Toolkit — Chromium post-exploitation via CDP

The CDP-Enable-BOF and CDP-Toolkit tools enable the Chrome DevTools Protocol (CDP) in an already running Chrome or Edge process without restarting the browser or using the --remote-debugging-port flag. CDP-Enable-BOF opens a local CDP interface while preserving the current profile, cookies, and active web sessions, while CDP-Toolkit automates browser interaction. The tools can collect browser state information, extract cookies and saved passwords, and control the browser through active user sessions.

Capabilities of CDP-Enable-BOF: • Enables CDP on a selected local port in Chrome and Edge processes, as well as in Chrome with process isolation • Locates internal Chromium functions by signature and updates the signatures when new browser versions are released

Capabilities of CDP-Toolkit: • Collects browser and user data: cookies, history, bookmarks, extensions, and saved-password metadata • Interacts with the browser: view, open, and close tabs, capture page snapshots, and navigate to websites

Article: https://specterops.io/blog/2026/08/13/chrome-devtools-protocol-cookie-theft/

Tools: • CDP-Enable-BOF (https://github.com/kingofthenops/CDP-Enable-BOF) • CDP-Toolkit (https://github.com/kingofthenops/CDP-toolkit)