A new Windows zero-day allows threat actors to use malicious JavaScript files to bypass Mark-of-the-Web security warnings. Threat actors are already seen using the zero-day bug in ransomware attacks.

Automatically opening downloaded files in Google Chrome is a relatively straightforward process. However, only certain file types can be opened automatically. Firstly, proceed by downloading a file.

However, opening an unknown JS file on Windows can be dangerous, as it runs inside Windows Script Host by default. From there, the script can easily run Windows executables.