CVE-2016-20090 Overview
CVE-2016-20090 is a local privilege escalation vulnerability in the Comodo Dragon Browser affecting versions up to 52.15.25.663. The flaw resides in the DragonUpdater service, which is installed with an unquoted service path and runs with SYSTEM privileges. A local attacker with limited rights can place a malicious executable along the unquoted path. Windows then loads the attacker-supplied binary when the service starts or the system reboots, granting code execution as SYSTEM. The issue is classified as Unquoted Search Path or Element [CWE-428].
Critical Impact
Successful exploitation grants SYSTEM-level code execution on Windows hosts running vulnerable Comodo Dragon Browser installations, enabling full host compromise from a low-privileged account.
Affected Products
- Comodo Dragon Browser versions up to and including 52.15.25.663
- The DragonUpdater Windows service component
- Windows endpoints where Comodo Dragon is installed under the default program path
Discovery Timeline
- 2026-06-19 - CVE-2016-20090 published to NVD
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2016-20090
Vulnerability Analysis
The vulnerability stems from how Windows resolves service binary paths when the ImagePath registry value contains spaces and is not enclosed in quotation marks. The DragonUpdater service is registered with an unquoted path that traverses directories containing spaces, such as C:\Program Files\Comodo\Dragon\dragon_updater.exe. When the Service Control Manager parses this path, it attempts to execute each space-delimited prefix as a candidate binary before reaching the intended executable.
Because the service runs in the LocalSystem context, any binary loaded along this search order inherits SYSTEM privileges. A local user who can write to an intermediate directory in the path can plant a malicious executable that Windows will execute on the next service start.
Root Cause
The root cause is improper quoting of the service binary path during installation of the Comodo Dragon Browser. The installer registers DragonUpdater with a raw path string instead of a quoted path, leaving the service vulnerable to Windows' fallback path resolution behavior described in [CWE-428].
Attack Vector
Exploitation requires local access with privileges sufficient to write a file into a writable directory that falls along the unquoted search path. The attacker drops a payload named to match the first space-delimited token (for example, Program.exe in the root of C:\, provided write access exists). Service restart, scheduled update execution, or system reboot triggers the malicious binary under the SYSTEM account. Exploit-DB entry 40471 documents a public proof of concept for this class of issue against Comodo Dragon.
No verified exploit code is reproduced here. Refer to the Exploit-DB #40471 entry and the VulnCheck Comodo Advisory for technical details.
Detection Methods for CVE-2016-20090
Indicators of Compromise
- Unexpected executables present at path prefixes such as C:\Program.exe or C:\Program Files\Comodo\Dragon.exe that do not belong to a legitimate installer.
- New child processes spawned by services.exe whose image path does not match the registered DragonUpdater binary location.
- Recent file creation events in directories along the DragonUpdater service ImagePath, particularly by non-administrative users.
Detection Strategies
- Enumerate Windows services with wmic service get name,pathname,startmode and flag any pathname value that contains spaces and is not wrapped in double quotes.
- Audit the HKLM\SYSTEM\CurrentControlSet\Services\DragonUpdater\ImagePath registry value for unquoted paths.
- Hunt for process creation events (Windows Event ID 4688 or Sysmon Event ID 1) where the parent is services.exe and the image path resolves outside the expected Comodo installation directory.
Monitoring Recommendations
- Monitor file write operations to directory roots such as C:\ and C:\Program Files\ by non-privileged accounts.
- Alert on modifications to service ImagePath registry values and on service binary replacement events.
- Track integrity of the Comodo Dragon installation directory and the DragonUpdater service configuration over time.
How to Mitigate CVE-2016-20090
Immediate Actions Required
- Inventory all endpoints for Comodo Dragon Browser installations and identify any version at or below 52.15.25.663.
- Remove or upgrade vulnerable Comodo Dragon installations, particularly on shared or multi-user systems where local users could plant payloads.
- Restrict write permissions on filesystem roots and intermediate directories that fall along unquoted service paths to administrators only.
Patch Information
No vendor patch reference is included in the enriched CVE data. Consult the VulnCheck Comodo Advisory and the Comodo Browser product page for the latest supported release, and uninstall the affected build if a fixed version is not available.
Workarounds
- Manually quote the DragonUpdater service ImagePath value in the registry so Windows resolves only the intended executable.
- Set the DragonUpdater service to Disabled until a corrected installation is deployed, accepting the loss of automatic update functionality.
- Apply NTFS access control lists that deny standard users write access to C:\ and other directory roots referenced by unquoted service paths.
# Inspect and remediate the unquoted service path (run as Administrator)
sc qc DragonUpdater
reg query "HKLM\SYSTEM\CurrentControlSet\Services\DragonUpdater" /v ImagePath
reg add "HKLM\SYSTEM\CurrentControlSet\Services\DragonUpdater" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\Comodo\Dragon\dragon_updater.exe\"" /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
