news Google reveals 0-day vulnerabilities affecting Google Chrome and Windows 7, recommends updating to Windows 10

[Badcam3]

Google’s Threat Analysis group has

This is the hidden content, please

• Sign In
• or
• Sign Up

affecting Google Chrome and Windows 7 PCs yesterday (via

This is the hidden content, please

• Sign In
• or
• Sign Up

). Google said it has already patched Chrome to remediate the vulnerability on March 1, and it’s recommending users to make sure that they have already updated the web browser to version 72.0.3626.121 or newer.

As for the Windows 7 vulnerability, Google says that it already reported it to Microsoft but had to reveal it yesterday after the end of its to a 90-day disclosure deadline. The Redmond giant is said to already be working on a fix, but according to Google this vulnerability is already being exploited in targeted attacks.

 

Quote

It is a local privilege escalation in the Windows win32k.sys kernel driver that can be used as a security sandbox escape. The vulnerability is a NULL pointer dereference in win32k!MNGetpItemFromIndex when NtUserMNDragOver() system call is called under specific circumstances.

We strongly believe this vulnerability may only be exploitable on Windows 7 due to recent exploit mitigations added in newer versions of Windows. To date, we have only observed active exploitation against Windows 7 32-bit systems.

 

As Microsoft has yet to announce when it will fix this vulnerability, Google is recommending Windows 7 users to upgrade their PCs to Windows 10. Microsoft announced yesterday that the new OS is now running on 800 million devices worldwide, but 43.93% of Windows users were still using Windows 7 in March according to

This is the hidden content, please

• Sign In
• or
• Sign Up

.

 

MY NOTE: Just because this is currently only being used against 32 bit versions of Windows 7 does not mean that the 64 bit version is safe. No where does anyone mention that windows 7 64bit is safe either. Just that it is has not being exploited on the 64bit version yet. It's just a matter of time. Microsoft has not even announced a fix yet.  PLEASE FOR THE LOVE OF GOD UPDATE TO WINDOWS 10. ITS FREE.

 

This is the hidden content, please

• Sign In
• or
• Sign Up

[Gamerone]

everybody read this⬆️

[MobCat]

@gamerone Windows 7 enterprise 64bit and I don't really use chrome also

Nope I will be the last grumpy old person running windows 7. I did the same thing with Windows XP till I needed more ram and TBH iv been running Windows 7 for this long with minimal issues (like 2 in the last 5 years) so I don't see any problem continuing to use win 7 till i run out of hardware support and if I'm careful and don't run or click on stupid stuff.

I wasn't going to comment on this as I'm pretty sure most people on NGR know my thoughts on windows 10 but gamerone tagged me soo I blame him. In conclusion No you should not run windows 7 but if you have to for work and you know what your doing then it's fine.

[Badcam3]

It's why I didn't tag you @MobCat I know how you feel about it and totally respect you and Ravenstorm. But I can still be worried for you guys 

[Gamerone]

Just trying to help @MobCat I like you reason i'm showing I care. If you'll be OK  i'm happy

That kind of looks like me when I get older maybe

[Ravenstorm]

I've been trying to upgrade but the upgrade method failed .. guess I'll have to buy it. soon

 

"To date, we have only observed active exploitation against Windows 7 32-bit systems. "

Maybe I'm ok? I DO need to update my Chrome though.. I don't use 32 bit windows 7.

[MobCat]

@Ravenstorm lol it's 2019 nobody should be using 32-bit anything >__<'

[RaptorJesus]

macOS and Linux all day long. Windows 10 can jam all kinds of sharp objects and Microsoft's refusal to support their last good OS (7, it will be their last good forever it seems) means I'll gladly spend the money on Apple gear for my primary, and SteamPlay / Lutris / Playstation everything else.

Also I'll never use a Google product, evil company, the most evil private company. I use Safari on macOS and Firefox / Waterfox on everything else, DuckDuckGo for searches and homebridge for home automation (testing out MyCroft for voice, not sold on it yet).

[Ravenstorm]

I trust no companies to ever keep my identity safe, respect my privacy, or never flub on security..to be honest..

[Lispat]

Yeah, let's install a Spyware-OS just so that we can avoid a single vulnerability.