CVE-2026-21514 & CVE-2026-21510 (Builders)

1; CVE-2026-21514 (SBX bypass or Protected View Bypass)

• Rebuild document package with obfuscated path to WindowsUpdateDiagnostic.xml inside word/rels/webSettings.xml.rels (Pending)
  
• Check other xml configs in path C:\Windows\diagnostics\index if they support this exploit primitives. (Pending)
  
• Remove any deformity in internal xml triggering abnormal behavior (Done)
  

2; CVE-2026-21510 (RCE)

• replace {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B} with the new one supporting this primitive ({8856F961-340A-11D0-A96B-00C04FD705A2} - Shell-Explorer.2). (Done)
  
• replace vector of lnk with .url file, or check if url files are accepted to load lnk files later (Bypassing SmartScreen - Experiment)
  
• replace htmlfile object with xmlfile object. (Done)
  
• replace dll with cpl file; reduces detection on rundll32, exhibits similar behavior without calling DllMain as entrypoint rather calls CPlApplet as entrypoint and control.exe is called instead (Pending)
  Limitation - spoofed file extinction is not supported unlikely to rundll32
  

NOTE: These are just some of experiments I did with this chain. You are responsible for your usecase (I believe you will just treat this research for educational purpose)