Andre Yoskowitz
31 Oct 2016 23:19
Google has revealed details of a 0-day vulnerability in the Windows operating system that it claims is being currently exploited.
The search giant disclosed the flaw to Microsoft just 10 days ago, but Microsoft has not yet released a patch or even an advisory.
Reads Google's post:
"The Windows vulnerability is a local privilege escalation in the Windows kernel that can be used as a security sandbox escape. It can be triggered via the win32k.sys system call NtSetWindowLongPtr() for the index GWLP_ID on a window handle with GWL_STYLE set to WS_CHILD. Chrome's sandbox blocks win32k.sys system calls using the Win32k lockdown mitigation on Windows 10, which prevents exploitation of this sandbox escape vulnerability.