Google discloses actively-exploited Windows zero-day vulnerability

The vulnerability gives an attacker admin-level control of the targeted Windows computer

Google has disclosed a zero-day vulnerability in the Windows operating system hackers are exploiting for privilege escalation, including the malicious sandbox escape.

Google’s Project Zero team first identified the bug and soon learned attackers were exploiting the vulnerability in the wild. Owing to the seriousness of the issue, Google reportedly gave Microsoft just a seven-day deadline to fix the flaw before announcing it.

When Microsoft failed to issue a security patch within the set timeframe, Google released the details of the zero-day vulnerability, which is now being tracked as CVE-2020-17087

According to Google’s report, the vulnerability exists within the Windows Kernel Cryptography Driver cng.sys and uses the previously patched CVE-2020-15999 vulnerability that allows attackers to run malicious code inside Chrome browsers for successful exploitation.

Users who’ve installed the latest Chrome security patches seem to have greater protection against the new zero-day vulnerability, which currently affects Windows 7, 8 and 10 computers.

Microsoft says there’s no evidence of widespread exploitation and that the vulnerability cannot surpass the cryptographic application programming interface (CryptoAPI) included with Microsoft Windows operating systems. Shane Huntley, director of Google’s Threat Analysis Group (TAG) said the vulnerability is targeted and the attacks are not related to US elections.

Ben Hawkes, team lead for Project Zero, expects Microsoft to release a patch for the zero-day security issue during Microsoft's next Patch Tuesday on November 10.

Featured Resources

Four cyber security essentials that your board of directors wants to know

The insights to help you deliver what they need

Download now

Data: A resource much too valuable to leave unprotected

Protect your data to protect your company

Download now

Improving cyber security for remote working

13 recommendations for security from any location

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

Recommended

Sopra Steria cyber attack costs to hit €50 million
Security

Sopra Steria cyber attack costs to hit €50 million

26 Nov 2020
Sophos warns customers of potential data leak
Security

Sophos warns customers of potential data leak

26 Nov 2020
Weekly threat roundup: VMware, GitHub, Facebook, and MobileIron
Security

Weekly threat roundup: VMware, GitHub, Facebook, and MobileIron

26 Nov 2020
Egregor ransomware could take up where Maze left off
Security

Egregor ransomware could take up where Maze left off

26 Nov 2020

Most Popular

80% of cyber professionals say the Computer Misuse Act is working against them
Security

80% of cyber professionals say the Computer Misuse Act is working against them

20 Nov 2020
Cisco acquires container security startup Banzai Cloud
Security

Cisco acquires container security startup Banzai Cloud

18 Nov 2020
350,000 Spotify users hacked in credential stuffing attack
Security

350,000 Spotify users hacked in credential stuffing attack

24 Nov 2020