{"uuid": "6af98910-a63c-4d06-891a-3cc8d36dfb9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3900", "type": "seen", "source": "https://infosec.exchange/users/wdormann/statuses/117135939742418630", "content": "Years ago I noticed that Google does certificate abuse similar to CVE-2013-3900 in their Chrome installers. (The fix for this is optional, despite being 13 years old)\nIf you make a thing behaves differently based on unsigned parts of a signed binary, you're abusing the code signing mechanism.\nRich Warren outlines how this can be abused for arbitrary command execution", "creation_timestamp": "2026-08-21T22:49:58.839063Z"}