CVE-2016-7189: Microsoft Edge Chakra engine memory corruption RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote code execution in a widely used browser with a high EPSS score, though exploitation requires user interaction and no KEV listing or public exploit tag is present.

What it is

The Chakra JavaScript engine in Microsoft Edge has a memory buffer overflow (CWE-119) that a crafted web site can trigger, leading to remote code execution. It matters because the browser is a common entry point and the flaw yields full code execution in the context of the browsing user.

Impact

An attacker who gets the victim to load a malicious page can run arbitrary code with the privileges of the Edge process, potentially leading to full system compromise.

Attack surface

Reached over the network by visiting a crafted web site; no authentication is required, but user interaction (opening the page) is needed per the CVSS vector AV:N/AC:H/PR:N/UI:R.

Exploitation

Not listed in CISA KEV and no reference tags indicate public exploit code; EPSS is high (0.48127, 98.8th percentile), suggesting elevated likelihood of exploitation activity.

What to do

• Apply Microsoft security update MS16-119 for Edge/Chakra.
• Keep Edge and Windows fully patched and restart to complete updates.
• Restrict or block untrusted web content and use network filtering for known malicious sites.
• Run browsers with reduced privileges and enable exploit mitigations (ASLR, DEP, Control Flow Guard).
• Consider disabling or limiting JavaScript in Edge for high-risk users where feasible.

Detection

• Monitor for Edge/Chakra crashes or abnormal process terminations that may indicate exploitation attempts.
• Hunt for suspicious child processes spawned by MicrosoftEdge.exe (e.g., cmd.exe, powershell.exe, script hosts).
• Review proxy and DNS logs for access to known exploit-hosting or malvertising domains.
• Check endpoint telemetry for memory corruption indicators and unusual code execution in browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.