Google has told the world about two new security problems in Microsoft Windows 7 and Windows 8.1. The findings come from Google’s Project Zero team. The team looks for hidden bugs that could let bad people break into computers.
What Google Said About the Bugs
Google said the first bug can let an attacker read (or decrypt) data on a Windows 7 or Windows 8.1 computer. The second bug can let an attacker use the computer’s power buttons. This means the attacker could turn the computer on, off, or restart it while pretending to be the user.
The second bug only affects Windows 7, not Windows 8.1. Google gave Microsoft 90 days to fix each problem. If Microsoft does not fix the bugs in that time, Google will make the details public.
Google’s report is dated October 17, 2014. That gave Microsoft about three months to work on a fix before the bugs could be shown to everyone.
How the Bugs Work
Both bugs are called “vulnerabilities.” A vulnerability is a mistake in the code that can be used by a hacker.
- Bug 1 – Data Decryption: This bug lets a hacker change encrypted data into readable data. Encrypted data is supposed to stay secret. If a hacker can read it, they can see passwords, personal files, or business information.
- Bug 2 – Power Function Access: This bug lets a hacker pretend to be the computer’s owner. The hacker can then press the power button, turn the computer off, or restart it. This can be used to cause chaos or hide other attacks.
Both bugs need the attacker to be close to the computer or to have some level of access already. Still, they are serious because they break the trust that users have in their machines.
What Microsoft Said
Microsoft did not like Google’s public disclosure. Earlier, Microsoft’s senior director of the Microsoft Security Response Center, Chris Betz, wrote a blog post. He asked Google to wait until a fix was ready before sharing details.
Betz said, “We asked Google to work with us to protect customers by withholding details until Tuesday, January 13, when we will be releasing a fix.” He called Google’s move “irresponsible” and said it could hurt customers.
Microsoft believes that a coordinated approach—where the company fixes the bug first and then tells the public—is the safest way. Google, however, follows a policy of 90‑day public disclosure if a fix is not ready.
Why Timely Fixes Matter
When a bug is found, two things happen fast: attackers try to use it, and defenders try to patch it. If a fix takes a long time, more computers stay at risk.
Here are simple steps you can take to stay safe, even if you use older Windows versions:
- Keep your Windows updates turned on. Microsoft often releases security patches automatically.
- Use a reputable antivirus program. It can spot known attacks that use these bugs.
- Back up important files regularly. If a bug lets a hacker read or delete data, you will still have copies.
- Consider upgrading to a newer Windows version. Windows 10 and Windows 11 receive regular security updates.
Even though the bugs were found in 2014, the ideas still matter today. New bugs keep appearing, and the debate about how quickly to tell the public continues.
FAQ
What is Project Zero?
Project Zero is a team at Google that searches for security bugs in many software products. Their goal is to make the internet safer by finding problems early.
Can I still be affected by these bugs?
If you still run Windows 7 or Windows 8.1 and have not installed the fixes, the bugs could affect you. Most people have moved to newer Windows versions, but some older machines are still in use.
Why did Google publish the bugs instead of waiting?
Google follows a policy of giving companies 90 days to fix a bug. If the company does not fix it, Google shares the details so users can protect themselves and pressure the company to act.
What should I do if I cannot update Windows?
Use a strong antivirus, avoid opening unknown files, and back up your data often. You may also consider switching to a supported operating system.
Conclusion
Google’s Project Zero team found two serious bugs in Windows 7 and Windows 8.1. One lets attackers read encrypted data, and the other lets them control the power button. Microsoft asked Google to wait for a fix before going public, but Google kept to its 90‑day rule. The story shows why quick fixes and clear communication are important for keeping computers safe.