A Google researcher details a Windows privilege escalation vulnerability, CVE-2026-66804, which can be exploited by abusing a dangling COM object registration. The issue is an incomplete fix for CVE-2026-50343, also known as the "Dark Elevator" bug. The vulnerability involves creating a custom COM marshaling object to load an arbitrary DLL into a privileged process.