#protocol-handlers

Analysis · May 20, 2026 · Colten Anderson

Everyone hardened against macros. Follina didn't use one.

CVE-2022-30190 (Follina) ran code from a Word document with no macro at all, by abusing a Windows URL protocol handler to invoke the Support Diagnostic Tool. It defeated macro-based defenses, and Microsoft had reportedly closed an earlier report as 'not a security issue.'