A security loophole impacts the Windows win32k.sys kernel driver, leading to privilege escalation on Windows 7.
Google identifies Windows vulnerabilities in targeted attacks related to the zero-day vulnerability (CVE-2019-5786) in the Chrome web browser. It has been patched in browser version 72.0.3626.121, released on 1st March last year.
Google advises users to upgrade to Windows 10.
Furthermore, the kernel driver vulnerability can be exploited for a Sandbox escape tool related to other security flaws in browsers. Hence, Windows users may still be affected even after updating to the latest Chrome browser version.
Google believes Windows 7 is the only operating system experiencing natural vulnerability exploits. Simply because Microsoft no longer supports Windows 7 and has shifted focus to the latest Windows versions, especially Windows 10.
If still running older Windows versions, users are advised to upgrade to Windows 10 and regularly update with the latest patches. Refer to the guide on upgrading Windows 7 to Windows 10 here.
Clement Lecigne, a member of Google's Threat Analysis Group, reveals a novel NULL Pointer Dereference vulnerability in win32k!MNGetpItemFromIndex. It occurs when the NtUserMNDragOver() system call is invoked under specific circumstances.
Microsoft acknowledges the existence of the vulnerability and is actively working on a fix. However, until the patch is released, Windows 7 users will be affected.
Update your Chrome browser correctly
While Chrome's auto-update feature installs new codes, it doesn't guarantee the deployment of security patches. Refer to the proper way to update Chrome here.
Justin Schuh, Technical Director and Security Lead for Chrome on computers, explains that Chrome can autonomously refresh its plugin components, and that's all there is to it.
However, if the browser code needs refreshing, the changes will take effect after restarting the browser, but it must be done manually in most cases.
This means users will have to launch the web browser to refresh the codes.
Facebook Messenger users are currently facing a privacy glitch where our past conversations are exposed. For more details, check out Facebook Messenger facing flaw revealing users' conversations here.
