Trend Micro AV gave any website command-line access to Windows PCs

Patch available. Update NOW

[tangor]

PCs running Trend Micro's Antivirus on Windows can be hijacked, infected with malware, or wiped clean by any website, thanks to a vulnerability in the security software.

The design blunders were discovered by Google Project Zero bod Tavis Ormandy. A patch is now available to address the remote-code execution flaw, so Trend Micro users should update their software as soon as possible.

[theregister.co.uk...]

[Andy Langton]

That exploit is absolutely insane. Also includes the ability to grab all browser passwords, which is pretty shocking for a secure password manager!

[bill]

If you'd like a good laugh, here's the Google thread of the original incident [code.google.com...]