It's an issue for the scenario I mentioned above which has been exploited in the wild for months now. You create a fake SHFOLDER.DLL or similar with your paylo

It's an issue for the scenario I mentioned above which has been exploited in the wild for months now. You create a fake SHFOLDER.DLL or similar with your payload in it and stick it on every hacked WordPress or similar site you can. Google Chrome's stupidly insecure download setup allows any website to automatically download the vulnerable DLL right to the Downloads directory with no user interaction required. Now, every single legitimate NSIS or InnoSetup installer that hasn't been patched against this vulnerability that the end user downloads and runs will use the infected DLL instead of the legitimate one. The above works regardless of how the admin has defined the search path. It's a legitimate vulnerability. Installers specifically should be hard coded to only use Windows DLLs from the Windows directories. Realistically, Google Chrome should be fixed to not be so dumb and insecure with EXEs and DLLs as well. It may have been by now but it was definitely vulnerable when NSIS fixed this exploit and it was the primary attack vector since browsers like Firefox don't allow websites to automatically download infected DLLs to your Download directory.