in: science & technology (the verge) today, google<u+2019>s threat analysis group disclosed a critical vulnerability in windows in a public post on the company<u+2019>s security blog. the bug itself is very specific <u+2014> allowing attackers to escape from security sandboxes through a flaw in the win32k system <u+2014> but it<u+2019>s serious enough to be categorized as critical, and according to google, it<u+2019>s being actively exploited. as a result, google went public just 10 days after reporting the bug to microsoft, before a patch could be coded and deployed. the result is that, while google has already deployed a fix to protect chrome users, windows itself is still vulnerable <u+2014> and now, everybody knows it. google<u+2019>s disclosure provides only a general description of the bug, giving users enough information to recognize a possible attack without making it too easy for criminals to replicate. exploiting the bug also depends on a separate exploit in adobe flash, for which the company has also released a patch. still, simply knowing that the bug exists will likely spur a lot of criminals to look for viable ways to exploit it against computers that have yet to update flash.
google just disclosed a major windows bug <u+2014> and microsoft isn<u+2019>t happy
guest post