I may very well be wrong, but that’s how I read the beginning of this blog post: https://medium.com/@TalBeerySec/glueball-the-story-of-cve-2020-1464-50091a1f98b

I may very well be wrong, but that’s how I read the beginning of this blog post: https://medium.com/@TalBeerySec/glueball-the-story-of-cve-2020-1464-50091a1f98bd https://medium.com/@TalBeerySec/glueball-the-story-of-cve-20...: “ Digitally signed files are more trusted by the Operating System. This higher trust allows such files to execute in sensitive contexts or excluded from Antivirus scans.” It seems that msi installer packages with a trusted code signature (1) are excluded from scans by various antivirus protections. Which kind of makes sense: driver packages may contain code that would trigger heuristics a lot. > Presumably paired with the OP "bug" means MS could, with an NSA letter say, drop malware on devices if those devices were using Windows Defender for AV. Microsoft can already do that. To be quite honest - pretty much every institution with the right signing powers can on practically all OS. Have you verified the latest chrome installer package? This bug seems to allow something more insidious: you could download the latest google chrome msi and append your payload jar to that msi and redistribute it. The signature remains valid. This allows bypassing the code signing checks even if you have no code signing powers. (1) not from Microsoft, Microsoft only hands out the certificates, the signing is done by the developer