Google’s Project Zero outs another yet to be patched Windows 10 security flaw

Google’s Project Zero computer and security researchers have just disclosed another Windows 10 security issue that has yet to be patched by Microsoft. With this latest saga, the search engine giant revealed an Elevation of Privilege flaw in Windows 10 which allows a normal user to gain administrator privileges (via The Verge.)

The full security flaw can be found here and was originally brought to Microsoft’s attention in November as part of a separate security issue with Windows 10. Microsoft addressed one of the issues, but labeled the elevation of Privilege flaw as “important” and not “critical,” claiming the flaw can only be exploited with a “specially crafted application.” Google, in turn, publicly and separately disclosed the Elevation of Privilege flaw today since Microsoft failed to patch it within Google’s 90-day period. The flaw only affects Windows 10, and you can read more on it below.

In order to execute the exploit you’d have to already be running code on the system at a normal user privilege level. It cannot be attacked remotely (without attacking a totally separate unfixed issue to get remote code execution), and also cannot be used from a sandbox such as those used by Edge and Chrome. The marking of this issue as High severity reflects the ease of exploitation for the type of issue, it’s easy to exploit, but it doesn’t take into account the prerequisites to exploiting the issue in the first place.

Microsoft already faced criticism from the Google Project Zero team following the discovery of a vulnerability in Edge this past weekend. It remains unclear if Microsoft will patch this latest flaw, but given how things have gone in the past between the two companies, they’re likely a few Microsoft engineers who are furiously working hard right now.