If the threat actor can obtain sufficient privileges on the devices, they may be able to install runtime tools to directly extract the contents of some or all of the system RAM. This can grant the actor access to the internal state of other applications executing on the device as they process potentially sensitive data (e.g., password, keys, credentials, financial data, PII, etc.) even if that data is never committed to storage in a file or database. If the access extends to physical RAM, this can enable the threat actor to bypass other inter-process security boundaries created by the operating system.

• CWE-284: Improper Access Control