Google discloses actively-exploited Windows zero-day vulnerability

The vulnerability gives an attacker admin-level control of the targeted Windows computer

Google has disclosed a zero-day vulnerability in the Windows operating system hackers are exploiting for privilege escalation, including the malicious sandbox escape.

Google’s Project Zero team first identified the bug and soon learned attackers were exploiting the vulnerability in the wild. Owing to the seriousness of the issue, Google reportedly gave Microsoft just a seven-day deadline to fix the flaw before announcing it.

When Microsoft failed to issue a security patch within the set timeframe, Google released the details of the zero-day vulnerability, which is now being tracked as CVE-2020-17087

According to Google’s report, the vulnerability exists within the Windows Kernel Cryptography Driver cng.sys and uses the previously patched CVE-2020-15999 vulnerability that allows attackers to run malicious code inside Chrome browsers for successful exploitation.

Users who’ve installed the latest Chrome security patches seem to have greater protection against the new zero-day vulnerability, which currently affects Windows 7, 8 and 10 computers.

Microsoft says there’s no evidence of widespread exploitation and that the vulnerability cannot surpass the cryptographic application programming interface (CryptoAPI) included with Microsoft Windows operating systems. Shane Huntley, director of Google’s Threat Analysis Group (TAG) said the vulnerability is targeted and the attacks are not related to US elections.

Ben Hawkes, team lead for Project Zero, expects Microsoft to release a patch for the zero-day security issue during Microsoft's next Patch Tuesday on November 10.

Featured Resources

B2B under quarantine

Key B2C e-commerce features B2B need to adopt to survive

Download now

The top three IT pains of the new reality and how to solve them

Driving more resiliency with unified operations and service management

Download now

The five essentials from your endpoint security partner

Empower your MSP business to operate efficiently

Download now

How fashion retailers are redesigning their digital future

Fashion retail guide

Download now

Recommended

Most employees put their workplace at risk by taking cyber security shortcuts
cyber security

Most employees put their workplace at risk by taking cyber security shortcuts

27 Jul 2021
Google Cloud seeks to abandon its ‘Killed By Google’ reputation
Software

Google Cloud seeks to abandon its ‘Killed By Google’ reputation

27 Jul 2021
Google adds 600 places to Singapore digital skills bootcamp
Careers & training

Google adds 600 places to Singapore digital skills bootcamp

27 Jul 2021
PayPal looks to block hate group funding
Security

PayPal looks to block hate group funding

26 Jul 2021

Most Popular

The benefits of workload optimisation
Sponsored

The benefits of workload optimisation

16 Jul 2021
Samsung Galaxy S21 5G review: A rose-tinted experience
Mobile Phones

Samsung Galaxy S21 5G review: A rose-tinted experience

14 Jul 2021
Six ways boards can step up support for cyber security
Business strategy

Six ways boards can step up support for cyber security

22 Jul 2021