[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1203":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1203","T1203","Exploitation for Client Execution",21,"MITRE","**What attackers do.** Attackers exploit vulnerabilities in client software, such as browsers, document readers, office suites or messaging apps, to run code when a user opens content or visits a page. This serves the Execution tactic and often follows phishing or a drive-by compromise.\n\n**How to defend.** Patch browsers, office suites and readers quickly and automatically, and remove unneeded client software and plugins. Enable exploit protection and sandboxing features, and open untrusted documents in protected or isolated views. Endpoint detection should watch what client applications spawn.\n\n**Signs to look for.** Look for client applications crashing and then spawning unusual child processes, writing executables to disk or making unexpected network connections. A common gap is slow patching of less visible client software such as PDF tools or chat applications.","Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.\n\nSeveral types exist:\n\n### Browser-based Exploitation","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1203\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"microsoft-patches-24-rce-flaws-in-office-suite","Microsoft Patches 24 RCE Flaws in Office Suite","2026-10-16T08:20:15.913+00:00",{"slug":25,"title":26,"published_at":27},"silent-lynx-exploits-unpatched-winrar-flaw-to-backdoor-cis-governments","Silent Lynx Exploits Unpatched WinRAR Flaw to Backdoor CIS Governments","2026-10-15T18:20:53.262+00:00",{"slug":29,"title":30,"published_at":31},"zero-click-candiru-spyware-delivered-via-malicious-ads-hits-al-jazeera","Zero-Click Candiru Spyware Delivered via Malicious Ads Hits Al Jazeera","2026-10-15T18:20:37.304+00:00",{"slug":33,"title":34,"published_at":35},"ai-accelerates-full-chain-chrome-exploit-development-to-just-six-days","AI Accelerates Full-Chain Chrome Exploit Development to Just Six Days","2026-10-14T12:20:21.412+00:00",{"slug":37,"title":38,"published_at":39},"agentic-pentesting-exposes-gaps-in-continuous-vulnerability-validation","Agentic Pentesting Exposes Gaps in Continuous Vulnerability Validation","2026-10-07T14:22:38.831+00:00",{"slug":41,"title":42,"published_at":43},"spectre-v2-btr-variant-extracts-linux-root-hashes-via-cpu-speculation","Spectre v2 BTR Variant Extracts Linux Root Hashes via CPU Speculation","2026-09-29T18:20:41.045+00:00",{"slug":45,"title":46,"published_at":47},"zero-day-chain-exploited-by-chinese-hackers-to-deploy-cleangulp-malware","Zero-Day Chain Exploited by Chinese Hackers to Deploy CLEANGULP Malware","2026-09-23T10:22:36.112+00:00",{"slug":49,"title":50,"published_at":51},"china-aligned-group-exploits-chrome-windows-zero-days-before-patches-available","China-Aligned Group Exploits Chrome & Windows Zero-Days Before Patches Available","2026-09-22T20:20:38.395+00:00",{"slug":53,"title":54,"published_at":55},"zero-day-exploit-chain-targets-ngos-via-spear-phishing-and-compromised-university-site","Zero-Day Exploit Chain Targets NGOs via Spear-Phishing and Compromised University Site","2026-09-15T08:20:56.69+00:00",{"slug":57,"title":58,"published_at":59},"unpatched-tencent-sogou-flaw-enables-one-click-backdoor-deployment","Unpatched Tencent Sogou Flaw Enables One-Click Backdoor Deployment","2026-09-14T12:20:23.379+00:00",{"slug":61,"title":62,"published_at":63},"unpatched-tencent-sogou-flaw-exploited-to-deploy-grayrabbit-backdoor","Unpatched Tencent Sogou Flaw Exploited to Deploy GrayRabbit Backdoor","2026-09-13T16:20:19.871+00:00",{"slug":65,"title":66,"published_at":67},"bluemoon-exploit-kit-chains-chrome-windows-zero-days-for-espionage","BlueMoon Exploit Kit Chains Chrome & Windows Zero-Days for Espionage","2026-09-12T12:20:26.148+00:00",[69,74,78,83,88,93],{"slug":70,"name":71,"problem":72,"stories":73},"patch-management","Automated patch management","Known holes get closed in days, not months.",17,{"slug":75,"name":76,"problem":77,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":79,"name":80,"problem":81,"stories":82},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",8,{"slug":84,"name":85,"problem":86,"stories":87},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",7,{"slug":89,"name":90,"problem":91,"stories":92},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",3,{"slug":94,"name":95,"problem":96,"stories":97},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",2,[99,104,110,115,120,125,129,133],{"family":100,"item":101,"code":102,"title":103,"together":9},"cis","7","Control 7","Continuous Vulnerability Management",{"family":105,"item":106,"code":107,"title":108,"together":109},"nist-sp","800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",18,{"family":111,"item":112,"code":113,"title":114,"together":73},"nist-800-53","si-2","SI-2","Flaw Remediation",{"family":116,"item":117,"code":118,"title":118,"together":119},"itil","overview","ITIL",13,{"family":100,"item":121,"code":122,"title":123,"together":124},"2","Control 2","Inventory and Control of Software Assets",10,{"family":111,"item":126,"code":127,"title":128,"together":124},"ra-5","RA-5","Vulnerability Monitoring and Scanning",{"family":100,"item":130,"code":131,"title":132,"together":82},"13","Control 13","Network Monitoring and Defense",{"family":111,"item":134,"code":135,"title":136,"together":82},"si-3","SI-3","Malicious Code Protection"]