Windows Bug Class: Accessing Trapped COM Objects with IDispatch
Google Project Zero's James Forshaw describes a Windows bug class in which COM objects reachable across process and security boundaries can be abused, citing CVE-2019-0555, where a malicious client queried the old IXMLDOMDocument interface to run an XSLT...