Executive Summary
Analysis of the July 2026 Windows security updates reveals a significant vulnerability in the private AppResolver interface. An attacker running code within a zero-capability AppContainer can leverage the `CreateAppResolverActivationArgs` factory to set a malicious protocol handler for the `ms-settings:` scheme. This bypasses the protected 'UserChoice' registry mechanism that usually requires a valid validation hash for protocol selection.
While the public CVE-2026-50454 record cites relative path traversal and file deletion, this research identifies a corresponding missing capability check in the same component. By hijacking `ms-settings`, an attacker can trigger auto-elevated binaries like `fodhelper.exe` to execute commands as a High-integrity administrator, subsequently escalating to SYSTEM via service creation. This demonstrates a reliable UAC bypass chain on vulnerable Windows 11 builds (e.g., 26200.8737).