Google’s Project Zero discloses Windows 0day that’s been under active exploit (opens in new tab)

Project Zero's disclosure policy as described in the article appears to leave little room, if any, for the bias you appear to be implying:

> In keeping with long-standing policy, Google’s vulnerability research group gave Microsoft a seven-day deadline to fix the security flaw because it’s under active exploit. Normally, Project Zero discloses vulnerabilities after 90 days or when a patch becomes available, whichever comes first.

In addition, the two bugs appear to be unrelated other than being used as part of the same attack chain. The Chrome/FreeType vulnerabilities were reported on 2020-10-19 [0, 1], while the Windows vulnerability was reported on 2020-10-22 [2]. The Chrome team released a fix for their bug the day after the it was reported [3], while Microsoft is either still working on fixing the bug or is waiting for Patch Tuesday.

[0]: https://bugs.chromium.org/p/chromium/issues/detail?id=113996...

[1]: https://savannah.nongnu.org/bugs/?59308

[2]: https://bugs.chromium.org/p/project-zero/issues/detail?id=21...

[3]: https://twitter.com/benhawkes/status/1318640422571266048

My understanding is that it’s not a full PoC. It’s enough to crash Windows, but not enough to do more than that. An attacker would likely need to do additional work to make it relevant to them unless they’re just a prankster. Given that the disclosure says exactly where an attacker would need to start looking, it doesn’t make much difference whether a PoC is released in this case.

This isn’t always true: sometimes knowing where to look is the easy part, and crafting a working exploit is the hard part. I don’t get the impression that’s the case here.