Chromium is no longer just a place to steal cookies from. It is a place for persistence and post exploitation for adversaries. This talk starts with remotely enabling Chrome DevTools Protocol (CDP) inside a live Chrome or Edge process as a post-exploitation primitive. Once CDP is exposed, the browser’s own debugging interface becomes an operator console: enumerate or open new tabs, capture screenshots of active browser sessions, steal browser cookies, inspect a user's history, enumerate and load extensions, proxy authenticated requests, and interact with web apps from the user’s trusted browser context all in a hidden context from the user. Instead of fighting protections like device-bound session cookies, we will highlight how we can operate through the browser they are bound to. Then we take the idea further: from browser control to browser persistence. We’ll examine how operators can abuse Chromium’s extension ecosystem, Native Messaging hosts, and Isolated Web Apps can be chained into a Mythic C2 agent for persistence. Along the way, we’ll cover how extension allowlist policies can be bypassed when trust is anchored to extension IDs. This talk will also enable defenders by illuminating what artifacts are left behind when operators abuse chromium browsers for post-exploitation primitives.