Window 7 users are currently being urged to upgrade immediately to Windows 10 with the recent discovery of a zero-day privilege escalation flaw.

Google security researchers say the flaw affects the Windows win32.sys kernel driver, which has already begun to target attacks in the wild.

These attacks combined with the recently-patched security flaw in Google’s Chrome web browser and win32.sys privilage escalation flaw have been observed. It is believed Windows security flaw right now only affects Windows 7 operating systems.

“We strongly believe this vulnerability may only be exploitable on Windows 7 due to recent exploit mitigations added in newer versions of Windows. To date, we have only observed active exploitation against Windows 7 32-bit systems. To date, we have only observed active exploitation against Windows 7 32-bit systems,” warned Clement Lecigne, a security engineer in Google’s Threat Analysis Group.

“When we discovered the vulnerability we reported it to Microsoft. Today, also in compliance with our policy, we are publicly disclosing its existence, because it is a serious vulnerability in Windows that we know was being actively exploited in targeted attacks. The unpatched Windows vulnerability can still be used to elevate privileges or combined with another browser vulnerability to evade security sandboxes.”

Though Microsoft is currently working on a solution for in Windows 7, the system may still be at risk to online attacks until they provide a solution.

The news of the flaw appeared just 10 months prior to Microsoft formally ending extended support for Windows 7. Organizations will be required to pay extra up to $50 per PC for security updates, but leaving home users vulnerable to attack.

“Past zero days targeted Chrome by using Flash as the first exploit in the chain. Because Flash is a plugin component, we could update it separately, and once updated Chrome would silently switch to the fixed Flash, without a browser restart or any user intervention,” he noted.

“This newest exploit is different, in that initial chain targeted Chrome code directly, and thus required the user to have restarted the browser after the update was downloaded. For most users the update download is automatic, but restart is a usually a manual action.”

For more information take a look at the original post: https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop.html