Loading story…
SafeBreach Labs disclosed CVE-2025-59199, a Windows 11 sandbox escape that allows a low-integrity process to gain medium-integrity code execution and perform arbitrary file writes after a single user click. The attack, dubbed "Click Or Trick," chains weaknesses across several Windows components rather than exploiting one isolated flaw, combining a misconfigured COM object, Windows app identity and toast notification behavior, Snipping Tool URI handling, URI decoding quirks, and Microsoft Teams' exposed Chromium remote debugging interface.
Researchers showed an attacker could launch a medium-integrity COM server from a low-integrity context, spoof a trusted toast notification, append attacker-controlled command-line arguments to legitimate applications, and then abuse the Chrome DevTools Protocol to write files outside the sandbox. Microsoft assigned the issue a CVSS 7.8 score after it was reported on July 13, 2025, and released a patch on October 14, 2025; the findings underscore how security gaps at the boundaries between unrelated Windows subsystems can be combined into a practical sandbox escape chain.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
SafeBreach Labs disclosed technical details for 'Click Or Trick,' its analysis of CVE-2025-59199, including how the exploit chain escaped the Windows 11 sandbox and enabled arbitrary file writes outside the sandbox boundary.
Microsoft patched CVE-2025-59199 on October 14, 2025. The vulnerability involved chaining multiple Windows components, including COM, toast notifications, URI handling, and Teams' exposed Chromium remote debugging interface.
SafeBreach reported the Windows 11 sandbox escape vulnerability CVE-2025-59199 to Microsoft. The flaw allowed a low-integrity process to achieve medium-integrity code execution and arbitrary file write with a single user click.
Microsoft advised customers to apply the September 2021 security updates for CVE-2021-40444, which addressed the MSHTML exploitation technique described in the campaign analysis.
Microsoft said public disclosure of CVE-2021-40444 on September 8, 2021, was followed by increased exploitation attempts and broader adoption by multiple threat actors.
Microsoft observed the earliest attacks exploiting CVE-2021-40444 on August 18, 2021, using specially crafted Office documents to trigger the MSHTML remote code execution vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
safebreach.com
Open sourcemicrosoft.com
Open sourceptsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft patched a critical Windows kernel elevation-of-privilege flaw, `CVE-2026-40369`, affecting Windows 11 versions 24H2 through 25H2 after public disclosure of technical details and proof-of-concept exploit code. The bug resides in `ntoskrnl.exe`, specifically `nt!ExpGetProcessInformation`, and can be triggered via `NtQuerySystemInformation`, including a zero-length request tied to information class `253`, causing an untrusted pointer dereference and unsafe kernel memory writes from an unprivileged process. Researchers said the vulnerability enables deterministic kernel memory modification, allowing attackers to build kernel read primitives, bypass KASLR, locate structures such as `EPROCESS`, alter token privileges, and ultimately obtain `NT AUTHORITY\SYSTEM` execution. Because the flaw is reachable from Chrome, Edge, and Firefox renderer sandboxes, it is considered especially dangerous for browser escape chains; defenders were urged to prioritize patching and watch for unusual `NtQuerySystemInformation` activity and anomalous kernel interaction patterns.
Jun 29, 2026
Microsoft disclosed **CVE-2025-33053**, an **Important** remote code execution flaw in **Internet Shortcut Files** that affects all supported versions of Windows and carries a **CVSS 8.8** rating. The vulnerability is tied to **CWE-73** (external control of file name or path) and can let an unauthenticated attacker execute code over a network if a user clicks a specially crafted URL. Microsoft said the bug had been **exploited in the wild**, that **functional exploit code** was available, and that security updates had been released. The advisory said the issue has implications beyond legacy browser use because underlying **MSHTML**, **EdgeHTML**, and scripting components remain supported on some platforms and are still used by **Internet Explorer mode**, the **WebBrowser control**, **WebView**, and some **UWP** applications. Microsoft also noted that **IE cumulative updates** still matter for certain older Windows Server systems, and later revised the advisory to correct the CVE title and description without changing the technical impact. Related Microsoft advisories show the flaw joins a broader pattern of remote code execution risks across Windows and server products, including **MSHTML**, **Hyper-V**, **Exchange Server**, and **SharePoint Server**.
Jun 29, 2026
Microsoft published security updates for multiple Windows elevation-of-privilege vulnerabilities affecting **Windows Shell**, **Windows User Interface Core**, and **Windows File Explorer**, including `CVE-2026-27918`, `CVE-2026-27911`, `CVE-2025-64661`, and `CVE-2025-64658`. The issues could allow attackers to gain higher privileges on a vulnerable system after obtaining local access, extending a pattern of privilege-escalation risk across core Windows components. Microsoft provided the most detail for **`CVE-2026-27911`**, which it rated **Important** with a **CVSS 3.1 score of 7.8**. The flaw stems from a **race condition** and **use-after-free** weakness in Windows User Interface Core and can be exploited by a low-privileged local attacker without user interaction. Successful exploitation could let an attacker escape a contained environment such as an **AppContainer**, raising privileges from **Low Integrity Level** to **Medium Integrity Level**. Microsoft said exploitation requires winning a race condition, assessed exploitation as unlikely at publication, and reported that the vulnerability had neither been publicly disclosed nor exploited before fixes were released.
Jul 5, 2026