Windows Exploitation Techniques: Dangling COM Object Registrations
This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. The root cause of the bug was a dangling COM object registration for the CrossDevice COM object with the CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}. A COM registration…
Excerpt from the primary source: Google Project Zero
Who is affected
Home users · Small businesses · Enterprises · Security professionals
Affected technology: Windows
What you should do · Patch
Apply the vendor's security update for Windows. Check the linked advisory for affected and fixed versions, and put internet-facing systems first.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Security research
Related
Chrome Dev for Desktop Update
The Dev channel has been updated to 157.0.8081.0 for Windows, Mac and Linux. A partial list of changes is available in the Git log . Interested in switching release channels? Find out how . If you find a new issue, please let us know by filing a bug . The community help forum is also a great place to reach out for help or learn about common issues. Chrome Release Team Google Chrome…
Extended Stable Update for Desktop
The Extended Stable channel has been updated to 152.0.7977.152 for Windows and Mac which will roll out over the coming days/weeks. A full list of changes in this build is available in the log . Interested in switching release channels? Find out how here . If you find a new issue, please let us know by filing a bug . The community help forum is also a great place to reach out for help or learn about common…
Chrome for Android Update
Hi, everyone! We've just released Chrome 154 (154.0.8037.126) for Android. It'll become available on Google Play over the next few days. This release includes stability and performance improvements. You can see a full list of the changes in the Git log . If you find a new issue, please let us know by filing a bug . Android releases contain the same security fixes as their corresponding Desktop releases (Windows &…
Stable Channel Update for Desktop
The Stable channel has been updated to 154.0.8037.97/.98 for Windows and Mac and 154.0.8037.97 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log Security changes will be updated shortly Interested in switching release channels? Find out how here . If you find a new issue, please let us know by filing a bug . The community help forum is also a…