CVE-2017-11802: Microsoft Edge and ChakraCore scripting engine memory corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityPublic exploit code and a very high EPSS score make exploitation likely, though the required user interaction and the age of the affected platforms temper the rating below critical.

What it is

CVE-2017-11802 is a memory corruption flaw in the ChakraCore scripting engine used by Microsoft Edge on Windows 10 and Windows Server 2016, caused by how the engine handles objects in memory. Successful exploitation lets an attacker run arbitrary code in the context of the current user, so the flaw matters wherever Edge or ChakraCore is in use.

Impact

An attacker gains arbitrary code execution with the privileges of the logged-in user, which can lead to full compromise of the user's session and data. Because the flaw is in the browser engine, the victim's own browsing context is the foothold.

Attack surface

The CVSS vector is network-reachable (AV:N) with user interaction required (UI:R) and no privileges required (PR:N), meaning a victim must open or view attacker-controlled web content in Edge or a ChakraCore host. No authentication is needed on the attacker's side.

Exploitation

The record is not listed in CISA KEV, but EPSS is high at 0.69163 (99.3rd percentile) and a public Exploit-DB entry (43000) exists, indicating exploit code is publicly available.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-11802 as the first action.
• Upgrade or retire unsupported Windows 10 builds (Gold, 1511, 1607, 1703) and Windows Server 2016 systems that cannot receive current patches.
• If ChakraCore is embedded in an application, update it to a fixed release or remove the dependency.
• Restrict browsing to trusted sites and block untrusted script content where Edge or ChakraCore is used.
• Consider disabling or removing Edge/ChakraCore on systems that do not require it.

Detection

• Monitor for crashes or abnormal process terminations in MicrosoftEdge.exe or ChakraCore hosts that could indicate memory corruption attempts.
• Hunt for Edge or ChakraCore processes spawning unexpected child processes such as cmd.exe, powershell.exe, or script interpreters.
• Review proxy and DNS logs for access to known exploit-hosting or malicious sites that deliver browser exploit content.
• Check endpoint telemetry for suspicious memory allocation or code injection patterns in browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.