Google's Project Zero discloses a zero-day sandbox exploit on Windows 7 and 10; Microsoft says it has no evidence of the flaw being widely exploited
New Hacker Attack Confirmed By Google, Microsoft project-zero : Issue 2104: Windows Kernel cng.sys pool-based buffer overflow in IOCTL 0x390400 Nathan Ord / HotHardware.com News : Google Project Zero Discloses Nasty Windows 0-Day Security Exploit Already In The Wild Waqas / HackRead : Google reveals details on active vulnerability affecting Windows 10, 7 Surur / MSPoweruser : Google reveals details of unpatched Zero day bug in Windows 10 Mark Wyciślik-Wilson / BetaNews : Google shares details of a Windows Kernel Cryptography Driver security flaw that's being exploited by hackers Catalin Cimpanu / ZDNet : Google discloses Windows zero-day exploited in the wild Zack Whittaker / TechCrunch : Google reveals a new Windows zero-day bug it says is under active attack Tweets: Sean Wright / @seanwrightsec : My personal view, giving a 7 day deadline is not helpful, and not a responsible way of disclosing publicly. https://arstechnica.com/... Lee Holmes / @lee_holmes : I'm trying to think through this one, and the only mitigation I can think of is API hooking and then filtering on specific parameter values, which the general public is not equipped to do. https://bugs.chromium.org/... Ryan Naraine / @ryanaraine : Google Project Zero: “We have evidence that the following bug is being used in the wild...” Unpatched Windows EoP 0day https://bugs.chromium.org/... Rain / @sunshowers6 : Windows has many of the very best systems programmers in the world working on it, and it still ends up shipping buffer overflows in crypto libraries. I'm not some sort of RIIR fanatic, but please do consider writing new systems software in Rust at least. https://twitter.com/... Zack Whittaker / @zackwhittaker : And on a Friday afternoon no less. https://arstechnica.com/...
Context & Ripple Effects
This is at least the third time Google has put Microsoft on the clock over a Windows kernel flaw. In 2015, [[a:825049|Project Zero posted an unpatched Windows 8.1 vulnerability the moment its 90-day deadline lapsed]], establishing the disclosure-cadence playbook. In 2019, a Chrome sandbox escape was revealed to have been chained with a separate zero-day against Windows 7 32-bit systems, showing how kernel-level escalation bugs get used in practice.
The new report follows the same structure: Project Zero published details of a pool-based buffer overflow in cng.sys, the Windows kernel cryptography driver, reachable via IOCTL 0x390400 on both Windows 7 and Windows 10, while Microsoft responded that it has no evidence of widespread exploitation. The disagreement between 'in the wild' and 'widely exploited' is where the two companies' disclosure philosophies collide again.
First-order effects
- Organizations running Windows 7 and Windows 10 face an unpatched local privilege-escalation vector in the kernel cryptography driver until Microsoft ships a fix, with public exploit detail now available to attackers.
Second-order effects
- Microsoft's 'no evidence of widespread exploitation' framing will be tested by the same chain-attack pattern seen in 2019, when a browser sandbox escape was paired with a Windows 7 kernel zero-day — meaning the practical risk depends on attackers combining this with a remote code-execution bug rather than using it standalone.
Third-order effects
- The recurring Project Zero-versus-Microsoft sequence points toward fixed-deadline disclosure becoming a structural forcing function on vendor patch quality, not just timing — a point underscored when [[a:961452|Microsoft's June patch for another privilege-escalation zero-day was later found not to fully fix the vulnerability]], leaving it exploitable with adjustments.
The trend: Kernel-level Windows zero-days are increasingly surfacing through Google's deadline-driven disclosure process, pushing Microsoft toward faster and more verifiable fixes.