Notifications
Clear all
Topic starter
01/08/2026 10:50 pm
TL;DR: A single click can chain misconfigured COM activation, URI handling quirks, and browser debugging access into arbitrary write and code execution from a low-integrity Windows process, leading to CVE-2025-59199 with a CVSS score of 7.8, according to SafeBreach. The result is a reminder that sandbox boundaries fail when separately safe components are composed without end-to-end identity and launch controls.
NHIMG editorial — based on content published by SafeBreach: Click Or Trick (CVE-2025-59199): Escaping the Sandbox with Windows URIs
By the numbers:
- The “Click Or Trick” vulnerability was assigned CVE-2025-59199 with a CVSS score of 7.8 and patched in October 2025.
Questions worth separating out
Q: What breaks when low-integrity sandbox boundaries are composed with launch and URI handlers?
A: The boundary breaks when a constrained process can trigger a higher-trust activation path that inherits a more capable token or launches a privileged helper.
Q: Why do Windows integrity levels fail to stop every privilege escalation path?
A: Integrity levels constrain object access, but they do not automatically govern every activation, redirect, or protocol-handling decision in the system.
Q: What do security teams get wrong about browser debugging ports in production?
A: They often treat remote debugging as a developer-only feature rather than a privileged runtime control surface.
Practitioner guidance
- Inventory low-integrity activation paths Map which COM objects can be activated from sandboxed processes and flag any server that launches with an unmodified logon token or a more privileged context.
- Restrict and validate URI-based launch handlers Audit Windows URI schemes that can invoke applications with command-line parameters, then remove or constrain handlers that accept redirected input into sensitive apps.
- Treat debugging ports as privileged services Disable remote debugging by default in production endpoints, and when it is required, bind it to explicit administrator workflows rather than ambient app launches.
What's in the full report
SafeBreach's full research covers the exploit chain detail this post intentionally leaves for the source:
- The exact COM object discovery path and the AppID flag behaviour that enabled medium-integrity launch from a low-integrity context
- The parameter-injection sequence used to move from Snipping Tool URI handling into a Chromium debugging surface
- The WebSocket commands used against Chrome DevTools Protocol to achieve arbitrary write
- The disclosure timeline, patch timing, and proof-of-concept validation steps
👉 Read SafeBreach's analysis of the Click Or Trick Windows sandbox escape →
Windows sandbox escape and URI tricks: what do defenders need to know?
Explore further
01/08/2026 10:58 pm
Windows sandbox escapes increasingly look like identity composition failures: the problem is not only whether a process is low-integrity, but whether activation paths, launch tokens, and handler chains preserve that boundary under composition. This research shows how separate subsystems can jointly defeat a control that each subsystem appears to honour on its own. For security teams, the practical conclusion is that endpoint hardening must include trust-path analysis, not just process-level isolation.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to The 2024 ESG Report: Managing Non-Human Identities.
A question worth separating out:
Q: Who is accountable when sandbox escape chains emerge from default Windows components?
A: Accountability sits with the platform owner for the operating system defaults, with endpoint security teams for local hardening, and with application owners for any service that exposes a dangerous launch surface. In practice, the governance failure is shared, because the exploit emerges at the junction of multiple controls rather than in one isolated product.
👉 Read our full editorial: Windows sandbox escape shows how URI handling can cross integrity boundaries
