Google’s Project Zero (GPZ) researchers were behind the discovery of the Meltdown and Spectre vulnerabilities in a wide range of processors earlier this year. Now, they have announced that Microsoft’s Windows 10 S suffers from a ‘medium severity’ exploit that can potentially allow users to run arbitrary code to jailbreak what is essentially a locked-down operating system. There seems to be no remote code to exploit the flaw right now, which means potential hackers will need physical access to the devices to unlock the OS.

windows 10 s mode

The researchers say that the vulnerability stems from how Windows 10 S verifies the identity of high-privilege components. According to the highly-technical note from GPZ:


Interestingly, Google and Microsoft have seemingly had a bit of a falling-out over the public disclosure of the vulnerabilities. Google says it notified Microsoft about its discovery on January 19th, following which, the Redmond giant had 90-days to patch up the flaws. As it turns out, Microsoft was originally planning to release the fix as part of the May Patch Tuesday. However, Google didn’t get on board with the time-frame as that was a long way beyond its 90-day deadline.

The Redmond giant then reportedly asked for a 14-day deadline extension with a promise to roll out the patch with upcoming Redstone 4 update, but Google once again turned Microsoft down citing the lack of a specific ETA, leading to the disagreement.