Comodo Dragon CVE-2025-8204

Exploitation requires user interaction (UI:P in CVSS vector) and high attack complexity (AC:H), meaning the attacker must socially engineer the user to visit a malicious or compromised website, and the vulnerability conditions must align with specific browser state or network positioning. The attacker must be capable of intercepting or modifying network traffic (implying network-adjacent positioning or control of network infrastructure, or a server capable of sending crafted responses). The vulnerability does not affect default-configuration browsing; it is triggered only when the HSTS Handler is presented with conditions that test its policy enforcement, such as a domain with an active HSTS policy or a scenario where the browser cache or policy state can be manipulated. Non-affected scenarios include users browsing standard HTTPS-only websites with correct HSTS headers and users whose browser cache has not been cleared or poisoned.

The real-world risk is low despite public exploit availability. CVSS 1.3 with AV:N/AC:H/UI:P reflects that while remote exploitation is possible, it requires high attack complexity and mandatory user interaction, severely limiting practical attack scenarios. EPSS score of 0.16% (36th percentile) indicates this vulnerability ranks below typical exploitable issues and suggests limited propensity for widespread automated attacks. The information disclosure impact (VI:L) is minimal. However, the presence of publicly available exploit code and vendor non-response create a concerning maintenance gap - users cannot rely on official patches. The gap between high-complexity CVSS requirements and public POC suggests the exploit targets edge-case scenarios or specific user behaviors rather than default-configuration attacks. This is a low-priority issue for most deployments, but organizations using Comodo Dragon in security-sensitive roles should consider alternatives pending vendor response.

An attacker crafts a malicious website or performs a man-in-the-middle attack that attempts to downgrade a user's connection from HTTPS to HTTP for a domain that enforces HSTS. Due to the HSTS Handler vulnerability, the browser fails to properly validate the HSTS policy and allows the downgrade, permitting the attacker to intercept and read sensitive data (such as cookies, authentication tokens, or form data) in plaintext. The attack requires the user to visit a manipulated or attacker-controlled page that triggers the weakness.