# Comodo Dragon Vulnerability

**Info:**

CVE-2025-8206

CVE-2025-8205

CVE-2025-8204

Comodo Dragon 64-bit version

**Download link:** [https://www.comodo.com/home/browsers-toolbars/browser.php](https://www.comodo.com/home/browsers-toolbars/browser.php)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752474786965/a84110eb-2f99-4f6b-a150-8e1336716c2d.png align="center")

1. **HSTS Problem**
    
    (Related to something like CWE-358: Improperly Implemented Security Check for Standard)
    

By default, normal browsers like Chromium do not allow users to connect to websites with invalid certificates if HSTS is enabled. However, Comodo Dragon has HSTS disabled. This allows users to click on "Proceed to website," which can lead them to a spoofed site.

**Steps to reproduce:**

* The attacker must have a web server with HTTPS enabled (an invalid certificate is acceptable).
    
* Modify the hosts file:  
    `<IP_of_fake_server>` [`google.com`](http://google.com)  
    (To fully demonstrate the attack vector, the attacker can set up a machine inside the LAN to perform DNS spoofing.)
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752474881341/1f03b5c7-6bab-49e0-b6c1-e9b0a7626279.png align="center")

\- Connect to [https://google.com](https://google.com) in Comodo Dragon, it shows a “Proceed to [google.com](http://google.com)” option.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752474894138/21506828-68a4-4866-97d5-144ce5811a07.png align="center")

\- User clicks on proceed to, connect success

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752474916888/c32c7099-46ab-4066-a0da-3467d375572e.png align="center")

Meanwhile, a normal browser is gonna to deny connection in first place

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752474929839/57a6ea7d-070f-4dcf-8bdc-ead5ea65fa0f.png align="center")

**2.    Insecure connection problem**  
Comodo Dragon includes a built-in extension called **“IP / DNS Leakage Detector”**, which uses an HTTP connection. An attacker can perform a DNS spoofing attack to exploit this.  
(To reproduce: modifying the `hosts` file on the victim's machine works as well.)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752474964168/b903db00-26b1-4e9a-a10a-f177a7853110.png align="center")

**3.    HTML Injection (must chain with the 2nd).**

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752474990755/5b69faf9-2ab5-42c9-ad46-70cf937093a2.png align="center")

Response values such as country name, etc., are inserted using the `innerHTML` property without any validation or sanitization.  
An attacker can combine this with the DNS spoofing (mentioned above) and send a malicious HTTP response that executes JavaScript or injects a phishing form.

On the spoofed server, the attacker can craft a fake response like this:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752475010621/bf54a04f-db55-495b-98b2-22e7aac36cf1.png align="center")

file test.html can has javascript code

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752475015907/901e27b7-3677-416b-bb89-4b3b80dff628.png align="center")

test with modified host file, js alert prompted

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752475025809/1a9d3128-a474-4459-af5f-599eeff65fbd.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752475038011/411a726e-3670-482c-a04f-0da48abf78d0.png align="center")

Contact: [Phong Xuan | LinkedIn](https://www.linkedin.com/in/phong-xuan/)