Local Privilege Escalation in Yandex Browser for Windows

CVE-2021-25261

What is CVE-2021-25261?

A local privilege escalation vulnerability exists in Yandex Browser for Windows that allows a low-privileged attacker to execute arbitrary code with SYSTEM privileges. This is achieved through the manipulation of symbolic links during the update process of the browser, affecting versions prior to 22.5.0.862. Attackers could exploit this flaw to gain elevated rights, potentially compromising system security.

References