Google published another unpatched Windows security flaw, according to the company's Project program policy Zero which discloses vulnerabilities 90 days after they are disclosed to the developer.
This time, the vulnerability is a type confusion in its module Microsoft Edge and Internet Explorer. Google researcher Ivan Fratric published a PoC showing how it can crash browsers, opening a door for potential attackers to gain administrative privileges on affected systems.
Fratric reports that he performed analysis on the 64-bit version of Internet Explorer on Windows Server 2012 R2, but also on two 32-bit versions of Internet Explorer 11 and Microsoft Edge. This means that Windows 7, Windows 8.1 and Windows 10 users are at immediate risk if they use Microsoft browsers.
Vulnerability was reported in 25 November, and according to Google Project Zero policy, it was announced publicly today 25 February, while Microsoft has not yet released a patch.
Let's say this is it second security flaw which was revealed by Google in two weeks, as the company also published details of the vulnerability in gdi32.dll originally reported to Microsoft in March of 2016.
So at this time there are two different security vulnerabilities that have not yet been repaired by Microsoft while the details have already been posted online on Google.
As we mention in the title of the article, to protect yourself it is recommended that you avoid doing click on websites you don't trust and also replace Internet Explorer and Microsoft Edge with a different one Browser.
