Comodo Dragon CVE-2025-8206

Exploitation requires the IP DNS Leakage Detector component to be active in Comodo Dragon (non-default configuration or must be explicitly enabled by user). Remote attacker must deliver a crafted payload via network response or malicious webpage that the user visits. User interaction is mandatory (UI:P) - the attack cannot proceed without the victim clicking, accessing a page, or triggering the detector. No authentication is required. Attack complexity is explicitly stated as high (AC:H), implying specific conditions such as precise crafting of the payload, specific browser state, or race conditions must be met. Limitation: the vulnerability does not affect default-configuration browsers that do not use Comodo Dragon, significantly reducing real-world exposure compared to mainstream browsers.

This vulnerability presents low real-world risk despite public exploit availability. CVSS 4.0 vector shows network attack surface (AV:N) but requires high complexity (AC:H) and user interaction (UI:P), limiting practical exploitability. EPSS score of 0.05% (15th percentile) contradicts the POC availability claim, suggesting either targeted rather than mass exploitation or that the exploit requires non-trivial setup. No CISA KEV listing indicates no confirmed active exploitation at scale. The integrity impact (VI:L) is minimal-XSS in a DNS detector context risks script execution but with limited privilege context compared to document/payment XSS in mainstream browsers. The disconnect between POC disclosure and EPSS/KEV absence suggests security researchers have published proof-of-concept but attackers have not widely weaponized it, possibly due to Comodo Dragon's limited market share compared to Chrome/Firefox.

An attacker crafts a malicious web page or network response that exploits the unpatched IP DNS Leakage Detector component, injecting JavaScript code into the detector's interface. When a Comodo Dragon user with this component active visits the malicious page or encounters a network-level injection, the malicious script executes in the detector's context, potentially stealing session data, redirecting to phishing pages, or exfiltrating DNS query logs. Public exploit code exists to automate this attack, though high attack complexity suggests it may require specific triggering conditions or user actions.