Executive brief
Comodo Chromodo is a web browser designed for privacy and security. A flaw in its update service allows a person with limited access to a computer to gain full administrative (SYSTEM) control. By placing a malicious file in a specific location, the attacker's code will run automatically when the computer restarts, potentially leading to a complete system takeover.
Technical details
The ChromodoUpdater service in Comodo Chromodo Browser (versions up to 52.15.25.664) is registered with an unquoted service path containing spaces (C:\Program Files\Comodo\Chromodo\chromodo_updater.exe). This is a CWE-428 vulnerability where the Windows Service Control Manager may attempt to execute files at truncated versions of the path if they exist (e.g., C:\Program.exe). A local attacker with write permissions to the parent directories can plant a malicious executable to intercept the service start. Because the service runs with LocalSystem privileges, the attacker achieves full privilege escalation upon a service restart or system reboot. The issue is resolved in version 52.15.25.665.
Affected products
- Comodo Chromodo Browser <= 52.15.25.664
Timeline
- 2016-10-03: disclosed: Initial contact with vendor
- 2016-10-05: patched: Fixed version 52.15.25.665 released
- 2016-10-06: other: Exploit-DB entry published
- 2026-06-19: advisory: NVD/VulnCheck advisory published