CVE-2016-7190: Microsoft Edge Chakra engine memory corruption RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote code execution in a browser engine with a high EPSS score, though exploitation requires user interaction and no KEV listing exists.

What it is

The Chakra JavaScript engine in Microsoft Edge has a memory corruption flaw (CWE-119) that a crafted web site can trigger. Successful exploitation allows arbitrary code execution or a denial of service. It is one of several similar scripting engine memory corruption bugs patched in the same cycle.

Impact

An attacker can run arbitrary code in the context of the Edge process, or crash the browser. Code execution would inherit the user's privileges.

Attack surface

Reached over the network by a user visiting a crafted web site; no authentication is required but user interaction (browsing to the page) is needed per the CVSS vector (AV:N/AC:H/PR:N/UI:R).

Exploitation

Not listed in CISA KEV and no reference tags indicate public exploit code, but EPSS is high (0.669, 99.3rd percentile), suggesting elevated real-world exploitation likelihood.

What to do

• Apply Microsoft security update MS16-119 (October 2016) to affected Edge/Windows systems.
• Prioritize patching on internet-facing or browsing-heavy endpoints.
• Keep Edge and the underlying OS at current supported patch levels.
• Reduce exposure by restricting untrusted web browsing where feasible.

Detection

• Monitor for Edge (MicrosoftEdge.exe) crashes consistent with memory corruption.
• Hunt for suspicious child processes spawned by Edge, such as script interpreters or shells.
• Review proxy/web logs for known exploit-hosting or malvertising domains.
• Correlate endpoint telemetry for anomalous code execution originating from the browser process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.