CVE-2016-7240: Microsoft Edge Chakra engine memory corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.5 with a public exploit and very high EPSS (99.2nd percentile) make exploitation likely despite the absence of KEV listing.

What it is

The Chakra JavaScript engine in Microsoft Edge contains a memory corruption flaw (CWE-119) that a crafted web page can trigger. Successful exploitation allows arbitrary code execution or a denial of service in the context of the browser. It is one of several distinct scripting engine memory corruption issues patched in the same Microsoft update.

Impact

An attacker can execute arbitrary code with the privileges of the Edge process or crash the browser, giving code execution or denial of service on the victim's machine.

Attack surface

Reached over the network by a victim visiting a crafted web site; no authentication is required, but user interaction (browsing to the page) is needed per the CVSS vector AV:N/AC:H/PR:N/UI:R.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but a public Exploit-DB entry (40773) exists and EPSS is very high at 0.665 (99.2nd percentile), indicating elevated likelihood of exploitation.

What to do

• Apply Microsoft security update MS16-129 (November 2016) to patch Edge and the Chakra engine.
• Keep Edge and Windows fully updated, since this class of flaw recurs across scripting engine releases.
• Restrict or disable JavaScript in Edge where operationally feasible, and block untrusted sites via policy.
• Use application control or browser isolation to limit the impact of a compromised renderer.
• Monitor vendor advisories for related Chakra memory corruption CVEs patched in the same bulletin.

Detection

• Hunt for Edge (MicrosoftEdge.exe) crashes or abnormal process terminations that may indicate memory corruption attempts.
• Monitor for suspicious child processes spawned by Edge, such as script interpreters or command shells.
• Review proxy and DNS logs for access to known exploit-hosting or malvertising domains.
• Correlate endpoint telemetry for exploit-like behavior in the browser process, including unusual memory allocation patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.