Google sums up 2023's security exploits: the good news is fixes are blocking some types of zero-day attack. The bad news is Windows has seen more than most

pcgamer.com:

2023 was a bumper year for zero-day exploits—50% more zero-day vulnerabilities were exploited last year compared to 2022—and the majority of them affected operating systems and products used by run-of-the-mill end users, such as Windows, Chrome and iOS. Though before the doom and gloom sinks in, Google does have some positive things to say about software security in 2023 in its yearly threat report.

Google's Threat Analysis Group (TAG) and Mandiant keep track of all the zero-day security vulnerabilities they discover out in the wild. Any hole in a security system that some nasty person wearing a long trench coat can take advantage of goes onto their joint yearly report (pdf), separated into whether it impacted end-users or enterprise software.

The first takeaway from the report is that there was a sharp increase in both end-user and enterprise zero-day vulnerabilities in 2023 compared to 2022. It notes 61 exploits impacting end-user software, such as operating systems, and 36 for enterprise software. That's compared to just 40 and 22, respectively, the year before. That might seem bad but end-user software had it a lot worse in 2021 at 81 counts.

The largest share of end-user exploits noted in the report go to Windows at 17, an increase of four on last year. The biggest increase year-on-year was actually for Apple's own brand of browser, Safari, which gained eight new exploits taking it up to 11 overall.

Surprisingly only a few exploits in the report were suspected of being financially motivated. Most were either government-led espionage or done by commercial surveillance vendors (CSVs), spyware firms that  actually develop «exploits against end-user products and platforms for use in highly targeted operations by government actors.» Must be a fun bunch. 

Google's report says the People's Republic of China leads the way in government-backed exploitation: «PRC cyber espionage groups exploited 12 zero-day vulnerabilities in 2023, up from seven in 2022,» the report