Loading vulnerability…
Click Or Trick is a Windows 11 local privilege escalation and sandbox escape vulnerability in the Software Protection Platform (SPP) attack surface that allows a low-integrity process to obtain medium-integrity execution with a single user click. The exploit chain abuses a COM server that can be activated from a low-integrity context and runs at medium integrity, specifically a broker component exposing a toast-notification function with attacker-controllable application identity and launch-command parameters. By spoofing a toast notification for a trusted application and appending attacker-controlled command-line arguments to the launched target, an attacker can pivot into URI handlers and packaged applications that accept controllable parameters. The demonstrated chain used Snipping Tool URI handling and URI decoding behavior to trigger a secondary application launch in a medium-integrity context, then abused Microsoft Teams' exposed Chromium remote debugging capability to gain a browser debugging interface. Through that interface, the attacker could direct downloads outside the low-integrity sandbox. The weakness is fundamentally an improper access control issue across Windows subsystem boundaries, where low-integrity code can influence higher-integrity application launch and execution flows through insufficiently constrained brokered functionality.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A separate Windows URI sandbox escape vulnerability referenced for comparison in the discussion of toast-notification exploitation.
A Windows 11 sandbox escape vulnerability that allows a low-integrity process to achieve escalated code execution and arbitrary file write with a single user click by chaining COM activation, app identity abuse, Snipping Tool URI handling, URI decoding quirks, and Chromium DevTools exposure.
One of 11 important vulnerabilities considered more likely to be exploited, ranging from remote code execution to privilege escalation across desktop and cloud environments.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.