Google criticised for releasing unpatched Windows bug

Google's Project Zero team have publicly released details of a Windows vulnerability but many are asking if it was the responsible thing to do

Google is facing strong criticism after releasing details of a Windows bug before Microsoft came up with a patch.

The security flaw was discovered by Google’s Project Zero team and potentially allows lower-level users on Windows 8.1 systems to launch an executable as if they had elevated privileges.

Google setup the Project Zero research team to pressure vendors into releasing fixes in a timely manner. Upon discovering a vulnerability, Google informs the firm responsible and gives it 90 days to patch the system. In this case, Microsoft missed the deadline and so Google published details of the flaw.

While Microsoft has received a fair amount of condemnation for not addressing the vulnerability sooner, but the vast majority of heat has been aimed at Google for releasing the details and potentially inviting the bad eggs to exploit the bug.

“Automatically disclosing this vulnerability when a deadline is reached with absolutely zero context strikes me as incredibly irresponsible and I'd have expected a greater degree of care and maturity from a company like Google,” one user wrote on the Google forum.

Google defended its position in a statement to Engadget:


Microsoft was also quick to comment on its lack of action, saying in a statement:



Read more on Threat Management Solutions and Services

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.