(Update 1: It seems that Logitech has launched an updated version of their Options software with a fix for the vulnerabiity - but this only happened after the vulnerabiiity became public. You can go on over Logitech's own webpage to download the updated version, which includes the fix in its changelogs, from here. Safe browsing.)

Adding to the critical vulnerability galore that's been coming out of Google's Project Zero, a researcher has demonstrated how an inherent bug in the "Logitech Options" software renders users vulnerable when visiting web pages. Tavis Ormandy, with Google Project Zero, found that Logitech Options opens a local Websocket port that doesn't require authentication for external commands. Attackers could exploit this issue by sending simulated keystrokes from any website - and thus execute pretty much anything on affected systems.Ormandy reported the issues to Logitech developers in September this year, and although Logitech recognized the problem, it still wasn't fixed in the last software release put out by the company. As part of Google Project Zero's responsible disclosure policy, Logitech was given a 90-day deadline to fix the issue - which they didn't, and hence, the vulnerability has been publicly disclosed. And as such, there's a whole world of potentially malicious hackers with the knowledge to execute this attack in the wild now - just uninstall the software until a fix is available, for your security. It's sure nice to have Options, but those shouldn't be given to hackers.