How a malicious link could bypass your PC’s built-in SmartScreen

2026-02-12 · Source: Dataconomy · Field: Technology & Digital — Cybersecurity & Data Privacy · Depth: Intermediate, quick

Summary

Microsoft has released urgent security updates to address multiple zero-day vulnerabilities in Windows and Office, which attackers were actively exploiting. These exploits include one-click attacks that allow hackers to install malware or gain unauthorized access with minimal user interaction. Specifically, two flaws can be triggered by clicking a malicious link on a Windows computer, while a third is activated by opening a malicious Office file. One critical vulnerability, CVE-2026-21510, is in the Windows shell and bypasses SmartScreen, enabling remote malware deployment. Another, CVE-2026-21513, affects the MSHTML browser engine, allowing attackers to bypass Windows security features. Google's Threat Intelligence Group assisted in discovering these flaws, confirming widespread active exploitation of the Windows shell bug, which can lead to high-privilege malware execution and system compromise.

Key takeaway

For IT Directors and security teams managing Windows and Office environments, your immediate priority must be to deploy Microsoft's latest security updates. These patches address actively exploited zero-day vulnerabilities that bypass SmartScreen and other security features, posing a significant risk of system compromise and ransomware. Ensure all systems are updated via Windows Update and Office Update services without delay to mitigate these critical threats.

Key insights

Zero-day vulnerabilities in Windows and Office are under active exploitation, bypassing built-in security features like SmartScreen.

Principles

• Zero-day exploits pose immediate, high-risk threats.
• User interaction remains a common attack vector.

In practice

• Update Windows and Office immediately.
• Exercise caution with suspicious links/files.

Topics

• Zero-day Vulnerabilities
• Windows Security Flaws
• SmartScreen Bypass
• Malware Exploitation
• MSHTML Engine Bug

Best for: CTO, VP of Engineering/Data, Director of AI/ML, Security Engineer, IT Professional, Software Engineer

Related on AIssential

• Attackers Are Exploiting Vulnerabilities 7 Days Before the Patch Exists. Now What? — The patch window is gone; AI-accelerated exploitation now precedes patch availability, demanding a shift to exploitation-based prioritization.
• Microsoft patches record 198 Windows bugs in June update - and 3 are zero days — AI-assisted analysis, exemplified by Claude Mythos, dramatically accelerates vulnerability discovery and patching in software.
• Hackers Used AI to Build Zero-Day Attack, Google Researchers Say — Access to Bloomberg.com content requires enabled JavaScript and cookies, as per their policies.
• These 5 critical Windows Defender settings are off by default - turn them on ASAP — Windows Defender offers advanced, disabled-by-default settings for enhanced PC security against diverse threats.
• Thanks NX bit — The CPU's NX bit prevents execution of injected code from non-executable memory regions like the stack, triggering a page fault.
• For the 2nd time in weeks, Microsoft packages laced with credential stealer — Supply chain attacks exploit trust models, not vulnerabilities, using compromised credentials to publish cryptographically verified malicious packages.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Dataconomy.