CVE-2016-20088: Chromodo Browser Privilege Escalation

CVE-2016-20088 Overview

CVE-2016-20088 is an unquoted service path vulnerability in Comodo Chromodo Browser version 52.15.25.664. The flaw resides in the ChromodoUpdater service, which runs with SYSTEM privileges on Windows hosts. A local authenticated attacker can place a malicious executable along the unquoted path and gain code execution at the highest privilege level when the service starts or the system reboots. The weakness is classified under CWE-428: Unquoted Search Path or Element. Public exploitation tooling exists in Exploit-DB #40473, and the issue is tracked in the VulnCheck Comodo Advisory.

Critical Impact
Local attackers with low-privileged access can escalate to SYSTEM by planting an executable in an unquoted Windows service path used by ChromodoUpdater.

Affected Products

Comodo Chromodo Browser 52.15.25.664
Comodo ChromodoUpdater Windows service
Windows endpoints with Chromodo Browser installed

Discovery Timeline

2026-06-19 - CVE-2016-20088 published to the National Vulnerability Database
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2016-20088

Vulnerability Analysis

The ChromodoUpdater service is registered on Windows with an ImagePath that contains spaces but is not enclosed in quotation marks. Windows resolves unquoted service paths by attempting to execute each space-delimited prefix as a binary, appending .exe and searching from the drive root downward. An attacker who can write to a directory along that resolution chain can drop a malicious executable that the Service Control Manager will launch instead of the intended updater binary.

Because ChromodoUpdater is configured to run as LocalSystem, the planted binary inherits SYSTEM privileges. This converts an ordinary local user account into a fully privileged operating system principal, bypassing User Account Control and standard access boundaries.

The vulnerability requires local access and the ability to write to one of the unquoted path segments. No user interaction is needed beyond a service restart or system reboot to trigger execution.

Root Cause

The root cause is improper handling of service binary paths during installation [CWE-428]. The installer registers the service without wrapping the executable path in double quotes, leaving the Windows Service Control Manager to perform a permissive, prefix-by-prefix lookup. Combined with directory permissions that allow non-administrative users to write files into intermediate path segments, this enables arbitrary binary substitution.

Attack Vector

An attacker with local low-privileged access enumerates Windows services using commands such as wmic service get name,pathname,startmode to identify any ImagePath containing spaces and lacking quotes. After locating the ChromodoUpdater entry, the attacker writes a malicious executable to a writable directory matching one of the resolved path prefixes. On the next service start or reboot, the Service Control Manager executes the planted binary as SYSTEM. Technical proof-of-concept details are documented in Exploit-DB #40473.

Detection Methods for CVE-2016-20088

Indicators of Compromise

Unexpected executables written to root-level or intermediate directories along the ChromodoUpdater service path.
New SYSTEM-owned processes spawned as children of services.exe that do not correspond to the legitimate updater binary.
Modifications to the HKLM\SYSTEM\CurrentControlSet\Services\ChromodoUpdater registry key or its ImagePath value.

Detection Strategies

Audit all Windows services for unquoted ImagePath values containing spaces using wmic service get name,pathname,startmode | findstr /i /v "\"".
Monitor file creation events in directories that sit on service path prefixes, particularly the system drive root.
Correlate service start events (Event ID 7036) with preceding file write events to the same path prefix.

Monitoring Recommendations

Enable Windows Security and System event log forwarding for service installation and startup events.
Track process lineage where services.exe spawns binaries outside expected install directories.
Alert on registry changes to Services\ChromodoUpdater\ImagePath and on new files dropped to writable path segments.

How to Mitigate CVE-2016-20088

Immediate Actions Required

Uninstall Comodo Chromodo Browser, which has reached end of life and is no longer maintained by Comodo Security Solutions.
If removal is not immediately possible, stop and disable the ChromodoUpdater service to prevent execution of the unquoted path.
Restrict write permissions on all directories that fall along the unquoted service path so that only administrators can create files there.

Patch Information

No vendor patch is referenced in available advisories. Comodo Chromodo Browser is a discontinued Chromium-based product, and affected users should migrate to a supported browser. Reference: Comodo Chromodo Browser Details and the VulnCheck Comodo Advisory.

Workarounds

Manually quote the ImagePath value for ChromodoUpdater in the registry to force the Service Control Manager to resolve the binary exactly.
Apply NTFS access control lists denying Write and Create Files permissions to non-administrators on C:\ and any intermediate directories on the service path.
Set the ChromodoUpdater service Start value to 4 (Disabled) until the application is removed.

bash

# Configuration example: quote the service ImagePath to neutralize CVE-2016-20088
sc.exe config ChromodoUpdater binPath= "\"C:\Program Files\Comodo\Chromodo\ChromodoUpdater.exe\""
sc.exe stop ChromodoUpdater
sc.exe config ChromodoUpdater start= disabled