Windows 10 RCE: The exploit is in the link | Positive Securi

Chaining a misconfiguration in IE11/Edge Legacy with an argument injection in a Windows 10/11 default URI handler and a bypass for a previous Electron patch, we developed a drive-by RCE exploit for Windows 10. The main vulnerability in the ms-officecmd URI handler has not been patched yet and can also be triggered through other browsers (requires confirmation of an inconspicuous dialog) and desktop applications that allow URI opening.

Related Keywords

Lukas Euler , Resolvebest Make , Sharepoint Onedrive , Localproviders Launchofficeappforresult , Microsoft Office , Microsoft Team , Microsoft Bug Bounty Program , Office Hub , Toc Research , Microsoft , Ms Office , Edge Legacy , Bug Bounty Program , Microsoft Teams Electron , Internet Explorer , Microsoft Edge Legacy , Microsoft Teams , While Windows , Windows Event Log , Reversing Localbridge , Edge Devtools Preview , Chromium Javascript , Electron Chromium , Windows Insider Dev , Windows Update , Windows Insider Dev Channel , Those Pocs , Electron Mitm , Office Add Ins , Microsoft Apps , Electron Apps , Web Socket Server , For Office Add Ins , Microsoft Edge ,