Google Project Zero detailed CVE-2026-66804, a Windows privilege escalation bug that turned out to be an incomplete fix for the earlier CVE-2026-50343 (“Dark Elevator”). The root cause is a dangling COM registration for the CrossDevice object (CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}), which was registered system-wide but pointed to a server DLL under %PROGRAMDATA%\CrossDevice that did not actually exist.
Because C:\ProgramData permits any user to create directories and files, an attacker could plant a malicious DLL at the expected path. When a system service instantiated the COM object, it would load the attacker’s DLL, granting code execution at higher privilege — a classic path to SYSTEM.
What to take away: dangling or orphaned COM registrations pointing to writable locations are a recurring local privilege escalation vector. Ensure the patch is applied, and monitor for unexpected DLLs and directory creation under ProgramData, since local EoP flaws like this are frequently chained after initial access to compromise domain-joined hosts.