Microsoft has addressed several critical security vulnerabilities in Windows and Office that pose significant risks to users. These vulnerabilities, referred to as zero-days, are being actively exploited by hackers to infiltrate computers through minimal user interaction, such as clicking on malicious links.
One notable flaw, tracked as CVE-2026-21510, affects the Windows shell and can bypass the SmartScreen feature designed to detect harmful content. This bug allows for the remote deployment of malware upon a victim's action. A security expert stated that although user interaction is required, such one-click exploits are uncommon and dangerous.
Another vulnerability, known as CVE-2026-21513, exists in the MSHTML browser engine, which is used for compatibility in newer Windows versions. This flaw also enables hackers to execute malware by circumventing existing security measures. Microsoft acknowledged the role of Google’s Threat Intelligence Group in identifying these vulnerabilities, which could lead to serious consequences like system compromise or ransomware deployment.