Google has warned those who are still using Windows 7 that they are at risk of hackers being able to take over their computer by exploiting the combination of a flaw in the Window 7 OS and Google’s Chrome Browser.

Google Alert

The threat to Windows 7 comes from combined flaws in its OS, and a flaw in Google Chrome.  It was Google that announced the discovery of the zero-day vulnerability CVE-2019-5786 in Chrome.

A zero-day vulnerability is one that gives Google, for example, zero days to find a fix because it is already being exploited.  In this case, Clement Lecigne, a security researcher at Google, discovered the vulnerability which resides in the Chrome web browsing software and could impact upon all major operating systems, not just Windows 7, although Windows 7 is vulnerable because it’s a 10-year-old OS in its final year of official support from Microsoft.

Details of the exact nature of the flaw in Googles’ Chrome are not abundantly clear at this point, but it has been described as a use-after-free vulnerability in the FileReader component of the Chrome browser. The FileReader is a standard API that enables web applications to asynchronously read the contents of files stored on a computer.  This essentially means that the flaw in Google’s Chrome provides a way in for hackers who can use it to transfer attack code from Chrome into other applications to help them compromise a machine.

The Windows 7 Side

The flaw in Windows 7 is reported to be in the very core elements that are supposed to stop the data in one program interacting with anything outside that application.

Combined

The combination of these two flaws means that hackers could use Google’s Chrome Browser to take over a computer running Windows 7.

What Can You Do?

The advice from security commentators is (unsurprisingly) to upgrade to Windows 10.  The advice from Google is to make sure that Google Chrome is up to date. You can do this by clicking on the three stacked dots (top right) in Chrome, selecting ‘Help’ and ‘About Google Chrome’, which takes you to the settings page chrome://settings/help.  If it says that you’re running Version 72.0.3626.121 (Official Build) you have the updated version.  If not, you need to update Chrome to the latest version.

What Does This Mean For Your Business?

According to Mr Lecigne, the Google security researcher, there is only evidence of active exploitation against Windows 7 32-bit systems, but it is alarming that a security flaw exists in the core elements of the OS. Since the real risk comes from the combination of a flaw in both Chrome and Windows 7, updating Chrome, which only takes a matter of minutes should provide protection (for the time being) from this risk, although it’s not possible to know what other zero-day bugs are waiting to be discovered.

This story shows the importance of keeping software up to date and patched and is likely to put more pressure on those businesses still using Windows 7 to make the switch to Windows 10.  The fact is though that Windows 7 is still a popular operating system with 37% market share and switching to Windows 10 has cost and time implications in terms of identifying any issues in individual environments and project planning.  The 14th Jan 2020 end of official support date for Windows 7 and the discovery of this kind of OS flaw being made public may now mean that businesses that have been holding out may simply feel that it’s time to bite the bullet and start the shift to Windows 10.