From helpnetsecurity.com
The danger of a Chrome / Windows exploit
The Windows bug is a local privilege escalation in the Windows win32k.sys kernel driver that can be used as a security sandbox escape, says Google threat analyst Clement Lecigne.
“We strongly believe this vulnerability may only be exploitable on Windows 7 due to recent exploit mitigations added in newer versions of Windows. To date, we have only observed active exploitation against Windows 7 32-bit systems,” he shared.
Google reported the bug to Microsoft and Microsoft has confirmed that they are working on a fix.
In the meantime, Google decided to publicly disclose its existence as it’s serious, can still be used to elevate privileges or combined with another browser vulnerability to evade security sandboxes, and is being actively exploited in targeted attacks.