Terry Myerson, Microsoft's executive vice president for Windows and devices, criticized Google's decision to publicly disclose a critical vulnerability found in the Windows kernel without a corresponding patch being made available first.
"Google is putting Windows at increased risk," Myerson said. "We believe that responsible participation in the technology industry requires putting the customer first, and requires collaboration in the disclosure of vulnerabilities. Google's decision to disclose these bugs before a patch has been widely available and tested is disappointing," he added.
Google's public disclosure of the vulnerability was made as part of the company's policy, which gives software companies 10 days to release patches for security vulnerabilities that have been marked as critical.
According to Google researchers Neel Mehta and Billy Leonard, the Windows vulnerability with identifier CVE-2016-7855 can be exploited to bypass the sandbox by exploiting a local privilege escalation bug in the Windows kernel.
Myerson provides some additional information about the vulnerability in a related post, stating that it is actively exploited by the hacking group STRONTIUM to conduct spear-phishing campaigns targeting computers vulnerable to two Adobe Flash security flaws.
The Microsoft executive adds that the campaign was identified by Google's Threat Analysis Team, and that the company is now working with all parties involved, including Google and Adobe, to patch the vulnerability and update vulnerable Windows systems. The patch is expected to be available next week, specifically on November 8 as part of the established Patch Tuesday.
"Windows is the only platform with a commitment to the customer in terms of investigating security issues that are revealed and proactively updating vulnerable devices as soon as possible," Myerson points out.
