Public disclosure and release of a tiny independent security research project about AOL Desktop Gold. This software is the successor of the AOL we all knew from the 90s, more like a wrapper I suppose.
About a year ago, Bruno, Chance, Joseph.Cohen.BT, and Jon ("GainSec") Gaines spent a few hours together. This is the result. We originally reached out to AOL on January 12, 2026. We also submitted the information to MITRE on October 24, 2025. We did not hear back from either. It has been a long time, and AOL Desktop Gold has likely been updated; we determined it is time to release the information. Nothing groundbreaking, but some cool stuff.
- October 24, 2025: CVE requests were submitted to MITRE.
- January 12, 2026: AOL was contacted by email.
- Tested version: AOL Desktop Gold 11.1.4959.
Supporting screenshots:
media/submitted-for-cve.png- MITRE CVE request submission confirmation.media/emailedaol2.jpg- AOL/Yahoo SecVuln email response.
| # | Finding | CVSS | Primary impact |
|---|---|---|---|
| 1 | Keyword Preference Hijack Requires Manual Payload Injection | 7.4 | Preference abuse / command execution path |
| 2 | NetInstall Preference Override Enables Signed Payload Execution | 8.6 | Signed payload execution |
| 3 | Compose EditorHost Bridge Enables Local File and NTLM Exfiltration | 8.3 | Local file disclosure and NTLMv2 hash capture |
| 4 | Mailto Inline Images Auto-Attach Local Files | 8.2 | Local file disclosure |
| 5 | Attachment Preview HTML Injection Enables Script/Protocol Execution | 8.8 | Script/protocol execution in preview surface |
| 6 | Favorites Import BinaryFormatter Allows Arbitrary Code | 8.3 | Deserialization code execution |
| 7 | Export Import Path Traversal Writes Outside Profile | 8.1 | Arbitrary file write via import |
| 8 | RTX Imports Execute Arbitrary HTML in Text Editor | 8.3 | HTML/script execution in editor |
| 9 | Signature Editor Executes Untrusted HTML with EditorHost Privileges | 8.3 | Stored script execution / file access |
| 10 | Remote Toolbar Payloads Execute Privileged Commands | 8.1 | Toolbar command injection |
| 11 | Production Builds Expose Debug Menu via Hidden Toggle | 6.8 | Debug functionality exposed in production |
| 12 | waol-att Scheme Enables Remote SSRF and Data Exfiltration | 8.6 | SSRF / data exfiltration |
| 13 | waol-embed Fallback Leaks Local Image Files | 6.5 | Local image file disclosure |
media/Finding1-Keyword-Hijack.mp4- Finding 1 proof video.media/Finding2-DotNetUpdate-Hijack.mp4- Finding 2 proof video.media/Finding7-Import-AolSave.mp4- Finding 7 proof video.media/ntlm-harvest-2-redacted.png- Finding 3 Responder screenshot showing NTLMv2-SSP capture.media/ntlm-harvest-3.png- Finding 3 DNS/HTTP WebDAV callback evidence.
The pocs directory contains the concrete proof-of-concept and helper files referenced by the findings. These should be included in any public package because several findings rely on these artifacts rather than only prose.
| Finding | PoC files |
|---|---|
| 1 | pocs/finding1_hijack_keyword.py, pocs/finding1_payload_keyword.html, pocs/finding1_set_keyword.url, pocs/finding1_trigger_keyword.url, pocs/finding1_social_phish.html |
| 2 | pocs/finding2_netinstall_listener.py, pocs/finding2_payload_netinstall.html |
| 3 | pocs/finding3_mailto_payload.txt |
| 4 | pocs/finding4_mailto_payload.txt |
| 5 | pocs/finding5_attachment_preview_xss.eml, pocs/finding5_attachment_protocol_poc.eml |
| 6 | pocs/finding6_FavPayload.cs, pocs/finding6_BuildFav.cs |
| 7 | pocs/finding7_build_exploit_aolsave.py |
| 8 | pocs/finding8_evil.rtx |
| 9 | pocs/finding9_signature_payload.html |
| 10 | pocs/finding10_override_pref.json, pocs/finding10_malicious_toolbar.json |
| 11 | pocs/finding11_enable_debug_menu.txt |
| 12 | pocs/finding12_waol_att_payload.html, pocs/finding12_waol_att_redirect.py |
| 13 | pocs/finding13_waol_embed_payload.html |
readme.md- public disclosure and finding index.pocs/- proof-of-concept and helper files referenced by the findings.media/- proof videos and supporting screenshots.