#uac

Analysis · May 20, 2026 · Colten Anderson

A clickable link in a SYSTEM dialog is a SYSTEM shell waiting to happen

CVE-2019-1388 turned a hyperlink in the UAC certificate dialog into a path to NT AUTHORITY\SYSTEM. No exploit code, just clicks: open the cert, click 'Issued by,' and the browser launches as SYSTEM. The lesson is what any interactive element in a privileged process really is.