Windows Lock Screen Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Windows improperly allows web content to load from the Windows lock screen. To exploit the vulnerability, an attacker with physical access to a user’s computer could either connect to a maliciously configured WiFi hotspot or insert a mobile broadband adaptor in the user’s computer.

An attacker who successfully exploited the vulnerability could potentially execute code on a user’s locked computer. However, the attacker would have no way to either force a user to connect to the hotspot or control the default browser selection on the user’s computer.

The security update addresses the vulnerability by correcting the behavior of the Windows lock screen to prevent unintended web content from loading.