Microsoft will release a patch on 8 November to patch a hitherto unknown vulnerability in Windows which was disclosed by Google staffers on Monday.
The company said a hacking group was actively exploiting this flaw and that the group had been previously linked to the Russian government.
No mention was made of a fix for a new method of code injection in Windows that was revealed on 30 October by the security firm enSilo that takes advantage of the design of the operating system.
In a blog post, Windows and Devices Group executive vice-president Terry Myerson said the hacking group that Microsoft Threat Intelligence calls Strontium had conducted a low-volume spear-phishing campaign.
{loadposition sam08}"Customers using Microsoft Edge on Windows 10 Anniversary Update are known to be protected from versions of this attack observed in the wild," Myerson said.
The attack used two zero-day vulnerabilities in Adobe Flash and the down-level Windows kernel to target customers.
"We have co-ordinated with Google and Adobe to investigate this malicious campaign and to create a patch for down-level versions of Windows," Myerson said.
"Along these lines, patches for all versions of Windows are now being tested by many industry participants, and we plan to release them publicly on 8 November."
Myerson criticised Google for releasing details of the flaw without first waiting for Microsoft to organise a fix. The search engine giant gave Microsoft only 10 days before leaking details.
"We believe responsible technology industry participation puts the customer first, and requires co-ordinated vulnerability disclosure," Myerson said. "Google’s decision to disclose these vulnerabilities before patches are broadly available and tested is disappointing, and puts customers at increased risk."