Cybersecurity researchers have uncovered a new vulnerability in Google’s Quick Share file transfer utility for Windows that could enable attackers to cause denial-of-service (DoS) conditions or send files to targets without their consent.

The flaw, identified as CVE-2024-10668 with a CVSS score of 5.9, bypasses fixes for two vulnerabilities that were part of the “QuickShell” disclosure made by SafeBreach Labs in August 2024. Google has addressed this issue in Quick Share for Windows version 1.0.2002.2.

The original QuickShell vulnerabilities (CVE-2024-38271 and CVE-2024-38272) could potentially be chained together to execute arbitrary code on Windows systems. Quick Share, formerly known as Nearby Share, functions similarly to Apple’s AirDrop, allowing peer-to-peer file transfers between Android devices, Chromebooks, and Windows computers in close proximity.

SafeBreach’s follow-up analysis revealed that Google’s initial fixes were incomplete. Attackers could still:

1. Trigger a DoS by using filenames starting with invalid UTF8 continuation bytes (e.g., “xc5xff”) instead of NULL terminators
2. Bypass file transfer consent by sending two files with identical “payload IDs” in the same session, causing the application to delete only one while leaving the other in the Downloads folder

SafeBreach researcher Or Yair emphasized that these findings highlight the importance of addressing the root causes of vulnerabilities rather than implementing superficial fixes, a lesson applicable across the software industry.