Google Exposes Active Windows Kernel Level 0-Day Vulnerability And It's Still Unpatched
"The Windows vulnerability is a local privilege escalation in the Windows kernel that can be used as a security sandbox escape. It can be triggered via the win32k.sys system call NtSetWindowLongPtr() for the index GWLP_ID on a window handle with GWL_STYLE set to WS_CHILD. Chrome's sandbox blocks win32k.sys system calls using the Win32k lockdown mitigation on Windows 10, which prevents exploitation of this sandbox escape vulnerability," Google stated in a blog post.
Microsoft and Google have never been in agreement with Google's policy of disclosing vulnerabilities after just seven days. While Google thinks it is imperative to inform users of critical security flaws that are being exploited, Microsoft feels the exploitation aspect is the very reason Google should be more patient.
Microsoft made a fuss when Google disclosed zero-day flaws in Windows 8.1 last year, though to no avail—Google responded by disclosing even more vulnerabilities just days later. Now the two are seemingly at odds again.
As for Windows 10, Microsoft squashed five zero-day bugs in a patch released earlier this month, so it's not as if Microsoft is sitting idle here.