Week of August 11, 2025

A zero-day vulnerability in Elastic's endpoint driver (elastic-endpoint-driver.sys) was disclosed, involving a NULL pointer dereference that can cause a Blue Screen of Death (BSOD). The researcher claims it can be used to bypass EDR detection, execute code, and establish persistence, though Elastic disputes the bypass and RCE claims. The flaw affects version 8.17.6 and likely later versions, with no patch available.

OpenText has made its Endpoint Detection and Response (EDR) product available in its Secure Cloud environment. This expands deployment options for the endpoint security tool. The announcement highlights a new delivery model for the existing EDR capability.

A publicly released proof-of-concept tool demonstrates in-memory bypass of Chromium's App-Bound Encryption (ABE) to extract cookies, passwords, browsing history, autofill data, and payment information from Chrome, Brave, and Edge without admin privileges. The tool uses direct syscall-based reflective process hollowing to evade endpoint defenses and operates filelessly. It highlights a technique that could be adopted by attackers to steal sensitive browser data.