Google discloses actively-exploited Windows zero-day vulnerability

The vulnerability gives an attacker admin-level control of the targeted Windows computer

Google has disclosed a zero-day vulnerability in the Windows operating system hackers are exploiting for privilege escalation, including the malicious sandbox escape.

Google’s Project Zero team first identified the bug and soon learned attackers were exploiting the vulnerability in the wild. Owing to the seriousness of the issue, Google reportedly gave Microsoft just a seven-day deadline to fix the flaw before announcing it.

When Microsoft failed to issue a security patch within the set timeframe, Google released the details of the zero-day vulnerability, which is now being tracked as CVE-2020-17087

According to Google’s report, the vulnerability exists within the Windows Kernel Cryptography Driver cng.sys and uses the previously patched CVE-2020-15999 vulnerability that allows attackers to run malicious code inside Chrome browsers for successful exploitation.

Users who’ve installed the latest Chrome security patches seem to have greater protection against the new zero-day vulnerability, which currently affects Windows 7, 8 and 10 computers.

Microsoft says there’s no evidence of widespread exploitation and that the vulnerability cannot surpass the cryptographic application programming interface (CryptoAPI) included with Microsoft Windows operating systems. Shane Huntley, director of Google’s Threat Analysis Group (TAG) said the vulnerability is targeted and the attacks are not related to US elections.

Ben Hawkes, team lead for Project Zero, expects Microsoft to release a patch for the zero-day security issue during Microsoft's next Patch Tuesday on November 10.

Featured Resources

Choosing a collaboration platform

Eight questions every IT leader should ask

Download now

Performance benchmark: PostgreSQL/ MongoDB

Helping developers choose a database

Download now

Customer service vs. customer experience

Three-step guide to modern customer experience

Download now

Taking a proactive approach to cyber security

A complete guide to penetration testing

Download now

Recommended

Geico data breach leads to stolen driver’s license numbers
data breaches

Geico data breach leads to stolen driver’s license numbers

21 Apr 2021
UK’s IoT security regulation will also include smartphones
Internet of Things (IoT)

UK’s IoT security regulation will also include smartphones

21 Apr 2021
eBay, Apple, Microsoft, Facebook, and Google were phishers’ top targets in 2020
phishing

eBay, Apple, Microsoft, Facebook, and Google were phishers’ top targets in 2020

20 Apr 2021
Siemens and Google Cloud join forces on factory automation
automation

Siemens and Google Cloud join forces on factory automation

19 Apr 2021

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

8 Apr 2021
Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
REvil threatens to release Apple’s hardware schematics
ransomware

REvil threatens to release Apple’s hardware schematics

21 Apr 2021