The title on HN understates the case at this point.  It&#x27;s not just remote code execution (more than bad enough, by itself).  If you are foolish enough to trust Trend Micro, they install a password store, whence:<p><pre><code>   Then you can use the decryptString API to decrypt all the strings, and then 
   POST them somewhere else.
    
   So this means, anyone on the internet can steal all of your passwords 
   completely silently, as well as execute arbitrary code with zero user 
   interaction. I really hope the gravity of this is clear to you, because I&#x27;m 
   astonished about this.

</code></pre>
You can convince their shit product to <i>POST ALL YOUR PASSWORDS</i> to an arbitrary server.