aPAColypse now: Exploiting Windows 10 in a Local Network with WPAD/PAC and JScript

Summary: Project Zero researchers Ivan Fratric, Thomas Dullien, James Forshaw and Steven Vittitoe found seven JScript vulnerabilities in jscript.dll, five of which can be triggered through WPAD/PAC on Windows 10, where every machine queries the local network via DHCP, DNS, WINS, LLMNR or NetBIOS for a JavaScript file to execute. Attackers can impersonate a DHCP server, spoof DNS replies to public resolvers, or register a wpad.tld domain to deliver malicious PAC files, and Microsoft has fixed all seven bugs.
Key Takeaway: Windows machines ask the local network where to find a JavaScript file to run, and the engine answering is the legacy jscript.dll from IE7/IE8 - so anyone who can race your DHCP server or register a wpad subdomain in your domain hierarchy can reach that code path before your browser is even open.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026