Google patches Quick Share for Windows to shut malware hole

Google has addressed multiple vulnerabilities in its Quick Share application for Windows, which could have allowed attackers to exploit the software for remote code execution (RCE). The vulnerabilities were discovered by SafeBreach researchers, who demonstrated how they could wirelessly write files to victims' PCs without consent and execute code by chaining together several flaws. The researchers identified ten vulnerabilities, including a denial of service flaw and an authorization bypass, which were assigned CVEs (CVE-2024-38271 and CVE-2024-38272). Google has since patched these issues, ensuring that the RCE chain is no longer viable. Quick Share, which facilitates file sharing between devices, was found to have a flaw that allowed attackers to bypass the necessary acceptance process for file transfers. The researchers also noted that the complexity of the Quick Share code contributed to the presence of these vulnerabilities. Following responsible disclosure, Google worked with SafeBreach to resolve the issues, emphasizing the importance of security in software development.

- Google patched vulnerabilities in Quick Share for Windows to prevent remote code execution.

- SafeBreach researchers discovered ten vulnerabilities, including a denial of service and authorization bypass.

- The flaws allowed attackers to wirelessly write files to victims' PCs without consent.

- Quick Share's complexity contributed to the presence of these security issues.

- Google collaborated with SafeBreach to address the vulnerabilities following responsible disclosure.