Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.(Citation: Kaspersky Autofill)

Browser information may also highlight additional targets after an adversary has access to valid credentials, especially [Credentials In Files](https://attack.mitre.org/techniques/T1552/001) associated with logins cached by a browser.

Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).(Citation: Chrome Roaming Profiles)
Browser Information Discovery
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1217  external_id: T1217     source_name: Chrome Roaming Profiles  description: Chrome Enterprise and Education Help. (n.d.). Use Chrome Browser with Roaming User Profiles. Retrieved March 28, 2023.  url: https://support.google.com/chrome/a/answer/7349337     source_name: Kaspersky Autofill  description: Golubev, S. (n.d.). How malware steals autofill data from browsers. Retrieved March 28, 2023.  url: https://www.kaspersky.com/blog/browser-data-theft/27871/     