Comodo Dragon Browser 52.15.25.663 Privilege Escalation via Unquoted Service Path

The DragonUpdater service is configured with an unquoted binary path: `C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe` [ref_id=1]. Because the path contains spaces and is not enclosed in quotes, Windows will resolve it by searching for executables named `C:\Program.exe`, `C:\Program Files.exe`, etc., before reaching the real target. A local attacker with low privileges can place a malicious executable named `Program.exe` or `Files.exe` in a location that appears earlier in the search order (e.g., `C:\`). When the service is restarted or the system is rebooted, the planted executable runs with SYSTEM privileges [ref_id=1].

The vendor fixed the issue in version 52.15.25.664 [ref_id=1]. The fix likely involves quoting the service binary path so that Windows treats the entire string as a single path rather than splitting it on spaces. Without a published patch, the exact change is not visible, but the standard remediation for an unquoted service path is to wrap the path in double quotes, e.g., `"C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe"`.