Session Cookie Theft via Browser Process Memory Access (T1539)

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•0

Detects instances where non-browser processes attempt to open a handle to common web browsers (Chrome, Edge, Firefox). This behavior is indicative of unauthorized memory access or process injection techniques often used to harvest session cookies or other sensitive data stored in browser memory space.