The problem is that Google also said this:

> The Windows vulnerability is a local privilege escalation in the Windows kernel that can be used as a security sandbox escape. It can be triggered via the win32k.sys system call NtSetWindowLongPtr() for the index GWLP_ID on a window handle with GWL_STYLE set to WS_CHILD.

Which is enough information for someone to write an exploit from scratch.

If they'd just said there is a win32k.sys vulnerability and advised users to make sure Flash is up to date, this would have been fine.