Google Threat Analysis Group Discovers Critical Microsoft Internet Explorer Bug

• An engineer from the Google Threat Analysis Group identified a zero-day Internet Explorer vulnerability that affected Windows 7 to Windows 10.
• The vulnerability was not revealed to the public until it was already patched by Microsoft in the latest builds of its OS.
• Users are requested to update their Windows OS as soon as possible to receive the security fix.

A scripting engine memory corruption vulnerability was found in Internet Explorer by a Google engineer. The vulnerability was detailed in CVE-2018-8653 and affected all installations of Internet Explorer on Windows 7, Windows 8.1 and Windows 10. Google’s Clement Lecigne from the Threat Analysis Group reported it to Microsoft.

The vulnerability was not disclosed to the public until Microsoft released a patch. The tech giant confirmed that only Internet Explorer was affected and its flagship Edge browser is secure. Users have been requested to download the latest Windows 10 cumulative updates if they are on Windows 10 and security patches for Windows 7 and Windows 8.1. The security update is listed under KB4483187.

Microsoft explained in a blog post “A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user.”

Whenever a current user logged in to a system with admin rights and used Internet Explorer, they were at risk of being attacked with hackers taking over the system. The exploit allowed hackers to install applications and modify or add new data to the system along with the ability to create new accounts with system admin privileges.

Microsoft is moving away from its Internet Explorer project and will solely be focused on Edge. Edge is set to receive a complete overhaul in the near future with the browser being built from scratch using the Chromium platform same as the Google Chrome is based on. The Microsoft browser will soon be able to take advantage of UWP apps as well as Chrome plugins.

What do you think about the Internet Explorer vulnerability found by Google? Let us know in the comments below. Check our socials on Facebook and Twitter for daily tech news.