CVE-2016-7200: Microsoft Edge Chakra engine out-of-bounds write memory corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is in CISA KEV with public exploits and very high EPSS, but it requires user interaction and affects an older browser generation.

What it is

The Chakra JavaScript engine in Microsoft Edge contains an out-of-bounds write (CWE-787) that corrupts memory when a crafted web page is processed. It is one of several distinct scripting engine memory corruption flaws patched in the same Microsoft update, and successful exploitation can lead to arbitrary code execution in the browser context.

Impact

An attacker can execute arbitrary code with the privileges of the Edge process or crash the browser, giving a foothold on the victim host if code execution succeeds.

Attack surface

Reached over the network by luring a user to a crafted web site; no authentication is required, but user interaction (opening the page) is needed per the CVSS vector AV:N/AC:L/PR:N/UI:R.

Exploitation

CVE-2016-7200 is listed in CISA KEV (added 2022-03-28) and has public exploit references on Exploit-DB and GitHub, with an EPSS 30-day probability of 0.8249 (99.6th percentile), indicating active exploitation is expected.

What to do

• Apply the Microsoft security update referenced in MS16-129 (the vendor patch) to all affected Edge/Chakra installations.
• Prioritize patching per CISA KEV required action and confirm remediation by the 2022-04-18 due date if still outstanding.
• Restrict or disable legacy Edge/Chakra usage where it is no longer required, and enforce current supported browser versions.
• Block or filter known exploit hosts and untrusted script content at the network and email gateway layers.
• Run browsers with reduced privileges and enable exploit mitigations to limit the impact of successful memory corruption.

Detection

• Monitor for Edge/Chakra process crashes and abnormal termination events that may indicate exploitation attempts.
• Hunt for network or proxy requests to known exploit-hosting domains and pages matching public PoC patterns.
• Review endpoint telemetry for suspicious child processes spawned by the browser, a common post-exploitation indicator.
• Correlate browser version inventory against the MS16-129 patch level to find unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.