drop chrome local state + prefs · parse app-bound v20 key blobs · dpapi + elevation service bypass indicators · runs locally
v20/app-bound key blobs · missing app_bound on chrome 127+ · IElevator / chrome_decrypt refs · legacy DPAPI-only paths
heuristic screener · parses chrome profile json locally · no decryption or live elevation service calls · not definitive proof