A newly disclosed vulnerability in Apple’s CarPlay ecosystem enables remote code execution with root privileges, posing a serious risk to connected vehicles. Discovered by the Oligo Security Research team and tracked as CVE-2025-24132, the flaw resides within the AirPlay protocol implementation used by CarPlay systems. CVE ID Affected Components Versions Impacted CVE-2025-24132 AirPlay Audio SDK < 2.7.1 […]
Sofia, Bulgaria, September 10th, 2025, CyberNewsWire Kikimora, a cybersecurity specialist and a product developer, has announced the launch of Kikimora Agent, a new AI-powered platform providing accessible cybersecurity management, vulnerability detection, and asset monitoring for businesses, individuals, and students. Kikimora Agent combines conversational AI with automated security workflows, reducing the workload for small and medium-sized […]
A security vulnerability has been found in the Google Drive Desktop application for Windows. It allows a logged-in user on a shared machine to access another user’s Drive files completely without needing their credentials.
This vulnerability stems from a broken access control mechanism in how the application handles cached data.
While Google Drive is widely trusted for its security and convenience by millions for storing sensitive data, this vulnerability challenges those assumptions.
The issue lies within the app’s local caching system, known as DriveFS, which fails to properly isolate cached files between different user profiles on a Windows system.
Vulnerability And Exploitation
According to Abdelghani Alhijawi, the Google Drive Desktop app caches synchronized files in a local directory (DriveFS).
Due to improper isolation, an attacker can access a victim’s cached DriveFS folder, copy its contents, and replace their own DriveFS folder with the victim’s data.
Upon restarting the application, Google Drive loads the victim’s entire drive, including “My Drive” and “Shared Drives,” as if it belonged to the attacker, without any re-authentication prompts.
Google Drive Desktop Windows Vulnerability
This exploit directly contravenes fundamental security principles:
Zero Trust: The application incorrectly trusts the copied cache without verifying the user identity.
Encryption at Rest: Cached files are not individually encrypted for each user, allowing them to be reused across different accounts.
Re-authentication: The application does not require a password or any form of re-login when a different user’s cache is loaded.
This vulnerability presents a classic insider threat scenario, particularly dangerous in environments with shared workstations like offices, universities, or co-working spaces.
An employee or any user on a shared system can covertly copy another person’s Drive cache, gaining access to sensitive files such as contracts, financial records, HR documents, or proprietary source code, Abdelghani Alhijawi said.
The potential for data exfiltration, modification, or deletion is substantial, posing risks of privacy violations, compliance failures under regulations like GDPR and HIPAA, and significant reputational damage.
Insider threats are a known and costly problem, accounting for 22% of security breaches according to the 2024 Verizon DBIR and costing companies an average of $15.38 million annually, as reported by a 2022 Ponemon/IBM study.
The vulnerability places the Google Drive Desktop app out of alignment with major global security standards like NIST SP 800-53, ISO 27001, and SOC 2.
These frameworks mandate strict data isolation, least privilege access, encryption of data at rest, and robust session management all of which are compromised by this flaw.
The researcher who discovered the issue reported it to Google’s vulnerability program but was told, “This is not considered a security bug.”
This response is concerning, as the flaw represents a failure to adhere to Zero Trust principles and leaves users exposed to significant risks.
Recommendations For Users
Until Google addresses this issue, users and organizations are advised to take precautions:
Avoid using Google Drive Desktop on shared or multi-user computers.
Enforce strict permissions on separate Windows user profiles.
Use the application only on dedicated and managed endpoints to minimize insider threat risks.
Ultimately, the responsibility for securing user data lies with the service provider.
By failing to implement per-user encryption, requiring re-authentication for cached sessions, and adhering to Zero Trust principles, Google Drive Desktop currently falls short of essential security expectations.
Microsoft on Tuesday addressed a set of 80 security flaws in its software, including one vulnerability that has been disclosed as publicly known at the time of release.
Of the 80 vulnerabilities, eight are rated Critical and 72 are rated Important in severity. None of the shortcomings has been exploited in the wild as a zero-day. Like last month, 38 of the disclosed flaws are related to
The Amp’ed RF BT-AP 111 Bluetooth Access Point has been discovered to expose its HTTP-based administrative interface entirely without authentication controls, enabling unauthenticated attackers with network access to seize full administrative privileges. This critical security oversight undermines fundamental defensive measures and places deployments at risk of unauthorized configuration changes, data interception, and network compromise. The […]
Millions of people and businesses trust Google Drive every day to store important files like contracts, reports, photos, and research papers. The desktop app for Windows promises secure and seamless syncing of files between local folders and the cloud. Yet a serious flaw in Google Drive Desktop for Windows breaks these promises. Any user on […]
KuCoin’s security team has uncovered a new phishing campaign orchestrated by the Lazarus Group (APT38), the notorious state-sponsored collective renowned for financially motivated cyberespionage. Armed with government resources and a history of high-profile breaches, Lazarus continues to evolve its tactics to target cryptocurrency and financial institutions worldwide. Over the last decade, Lazarus has homed in […]
HackerOne, a leading vulnerability coordination platform, has confirmed that its Salesforce environment was compromised in a recent third-party data breach. The incident stemmed from an attack on the Drift application provided by Salesloft, which allowed unauthorized actors to gain entry to records stored in Salesforce. While no customer vulnerability data appears to have been exposed, […]
Microsoft has disclosed two serious security vulnerabilities in its Office suite that allow attackers to execute arbitrary code on affected systems. Both flaws were publicly released on September 9, 2025, and have been assigned CVE identifiers CVE-2025-54910 and CVE-2025-54906. These critical issues affect Microsoft Office on Windows and can be exploited by attackers to gain […]
Apple on Tuesday revealed a new security feature called Memory Integrity Enforcement (MIE) that’s built into its newly introduced iPhone models, including iPhone 17 and iPhone Air.
MIE, per the tech giant, offers “always-on memory safety protection” across critical attack surfaces such as the kernel and over 70 userland processes without sacrificing device performance by designing its A19 and
