Connect with us

Hi, what are you looking for?



Maxthon Browser Vulnerability Can Help Attackers in Post-Exploitation Phase

Researchers have discovered a vulnerability in the Maxthon 5 Browser for Windows. Maxthon is a freeware browser developed by Maxthon Ltd, a firm headquartered in Beijing, China, and with offices in San Francisco, CA. Maxthon claims to be the default browser for 670 million worldwide users.

Researchers have discovered a vulnerability in the Maxthon 5 Browser for Windows. Maxthon is a freeware browser developed by Maxthon Ltd, a firm headquartered in Beijing, China, and with offices in San Francisco, CA. Maxthon claims to be the default browser for 670 million worldwide users.

The vulnerability was discovered by researchers at SafeBreach Labs, and has been designated the reference CVE-2019-16647. Exploitation requires administrator privileges, but post exploitation it can be used to achieve privilege escalation, persistence and in some cases defense evasion. SafeBreach has reported the vulnerability to Maxthon, who has confirmed receipt and provided a timeline for a fix. Neither the timeline nor confirmation that the fix is effective have been published.

The vulnerability occurs because part of the Maxthon software — including MxService.exe — runs as ‘NT AUTHORITYSYSTEM’, giving it powerful permissions and capabilities. It is signed by Maxthon Technology Co, Ltd, so any malicious payload executed by MxService gets an application whitelisting bypass. And it starts automatically on system boot, providing a persistence mechanism.

The problem occurs because services.exe looks for a file it cannot find (program.exe). By simply dropping their own ‘program.exe’ as a PoC, the researchers demonstrated that their unsigned payload still ran as NT AUTHORITYSYSTEM, providing scope for further privilege escalation.

The basic cause of the problem lies in the Maxthon browser installation phase. sprintf is called to format the buffer containing the path of the service executable. However, the path is not a quoted string. The final path includes ‘Program Files’ (containing a space). The CreateServiceW function doesn’t know whether it’s part of the path or whether it’s an argument, and tries to parse the first word. “Program Files” is firstly ‘Program’ (which it doesn’t find), and then ‘Program.exe’ (which it either doesn’t find or finds a potentially malicious insertion instead).

It is a simple coding error that should be easily fixable. The solution is specified in the CreateServiceW function documentation in MSDN: “If the path contains a space, it must be quoted so that it is correctly interpreted.” Because of the space between ‘Program’ and ‘Files’ in the specified path, the entire path should have been, but was not, contained in double quotes.

Without being fixed, however, a malicious payload gains persistence by being loaded every time the browser is restarted. “This way,” warn the researchers, “the malicious payload might not be detected by security products, because the service process which executes the attacker’s payload is signed, and executes it ‘natively’. No suspicious action is required by the attacker. The serviceit just executes the malicious executable once it is started.”

While this should be a simple fix, we do not at this time have confirmation on whether it has or when it will be fixed by Maxthon. The latest official version is 5.2.7, released prior to Safebreach’s notification to Maxthon, and included by SafeBreach as among the affected versions (5.1.0 to 5.2.7). The latest beta version of Maxthon ( was released after SafeBreach’s notification — but the key changes release note contains no mention of a relevant fix.

Advertisement. Scroll to continue reading.

Maxthon is no stranger to controversy. In 2016, researchers at Fidelis and Exatel found that the browser was regularly sending data that included information on the operating system, CPU, ad blocker status, homepage URL, websites visited by the user (including online searches), and installed applications and their version number to Maxthon’s server. Although encrypted, it could easily be decrypted — leaving the data vulnerable to man-in-the-middle attacks. This was in the early stages of the growing concern about Chinese companies having access to non-Chinese personal data.

This data was being collected even if the user opted out of the so-called User Experience Improvement Program under which it was collected.

Related: Browser Extensions Massively Collecting User Data 

Related: Mac Malware Steals Browser Cookies, Sensitive Data

Related: Archive Server of Pale Moon Open Source Browser Hacked 

Related: U.S. Blocks China Mobile, Citing National Security 

Written By

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Click to comment


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.


Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.