Based on your question I assume that you understand how SSL interception works in general, i.e. that the SSL intercepting process (the antivirus in this case) essentially replaces the original end-to-end encrypted connection with an encrypted connection from proxy to server and with another connection from client to proxy - where the last one does not use the original server certificate but a certificate created by the proxy and issued by a proxy-specific CA trusted by the client.
The question remains then how the local AV can put its proxy into the path of the traffic. One way would be to explicitly configure the proxy in the browser. A more transparent way on Windows is to use the Windows Filtering Platform (WFP) which is explicitly designed for this kind of traffic interception. To cite from Porting Packet-Processing Drivers and Apps to WFP:
Windows Filtering Platform (WFP) enables TCP/IP packet filtering, inspection, and modification, connection monitoring or authorization, IPsec rules and processing, and RPC filtering ...
In other words: no injection into the client is needed. Instead WFP defines a supported interface how application traffic can be intercepted and modified. Given that all traffic between an application and the remote communication peer will ultimately pass through the network stack of the OS WFP essentially provides supported hooks into this network stack and allows interception and modification without changing the application. This kind of hooks are also used by libraries like WinDivert which allow traffic interception and modification from user mode.
The documentation of ESET AV also confirms that they are using WFP. To cite:
Starting with Windows Vista Service Pack 1, Windows 7 and Windows Server 2008, the new Windows Filtering Platform (WFP) architecture is used to check network communication. ...
There are also other ways to do similar things even before WFP was available, for example with NDIS filter drivers. And there are more ways, including injecting a DLL into the application. For some information see Comparison of User Mode and Kernel Mode Applications for Modifying HTTP Traffic.