CVE-2016-20088

Comodo Chromodo Browser 52.15.25.664 contains an unquoted service path vulnerability in the ChromodoUpdater service that runs with SYSTEM privileges. A local attacker can insert a malicious executable in the service path and execute arbitrary code with elevated privileges upon service restart or system reboot.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://yildirimyunus.com
https://www.comodo.com
https://www.comodo.com/home/browsers-toolbars/chromodo-private-internet-browser.php
https://www.exploit-db.com/exploits/40473
https://www.vulncheck.com/advisories/comodo-chromodo-browser-unquoted-service-path-privilege-escalation

Configurations

No configuration.

History

29 Sep 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) Comodo Chromodo Navegador 52.15.25.664 contiene una vulnerabilidad de ruta de servicio sin comillas en el servicio ChromodoUpdater que se ejecuta con privilegios de SYSTEM. Un atacante local puede insertar un ejecutable malicioso en la ruta del servicio y ejecutar código arbitrario con privilegios elevados al reiniciar el servicio o al reiniciar el sistema.

Information

Published : 2026-06-19 15:16

Updated : 2026-09-29 09:10

NVD link : CVE-2016-20088

Mitre link : CVE-2016-20088

CVE.ORG link : CVE-2016-20088

JSON object : View

Products Affected

No product.

CWE

CWE-428

Unquoted Search Path or Element

{"id": "CVE-2016-20088", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2016-20088", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-22T15:48:35.899847Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Comodo", "product": "Chromodo Browser", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "52.15.25.664"}]}]}], "published": "2026-06-19T15:16:32.530", "references": [{"url": "http://yildirimyunus.com", "source": "disclosure@vulncheck.com"}, {"url": "https://www.comodo.com", "source": "disclosure@vulncheck.com"}, {"url": "https://www.comodo.com/home/browsers-toolbars/chromodo-private-internet-browser.php", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/40473", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/comodo-chromodo-browser-unquoted-service-path-privilege-escalation", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-428"}]}], "descriptions": [{"lang": "en", "value": "Comodo Chromodo Browser 52.15.25.664 contains an unquoted service path vulnerability in the ChromodoUpdater service that runs with SYSTEM privileges. A local attacker can insert a malicious executable in the service path and execute arbitrary code with elevated privileges upon service restart or system reboot."}, {"lang": "es", "value": "Comodo Chromodo Navegador 52.15.25.664 contiene una vulnerabilidad de ruta de servicio sin comillas en el servicio ChromodoUpdater que se ejecuta con privilegios de SYSTEM. Un atacante local puede insertar un ejecutable malicioso en la ruta del servicio y ejecutar c\u00f3digo arbitrario con privilegios elevados al reiniciar el servicio o al reiniciar el sistema."}], "lastModified": "2026-09-29T09:10:00.157", "sourceIdentifier": "disclosure@vulncheck.com"}