CVE-2017-11811: Microsoft Edge and ChakraCore scripting engine memory corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.5 with a public exploit and very high EPSS, though no KEV listing or confirmed active exploitation in this record.

What it is

CVE-2017-11811 is a memory corruption flaw in the ChakraCore scripting engine used by Microsoft Edge on Windows 10 and Windows Server 2016. The engine mishandles objects in memory, allowing an attacker to execute arbitrary code in the context of the current user. It is one of a large batch of similar scripting engine flaws patched in October 2017.

Impact

An attacker who successfully exploits this can run arbitrary code with the privileges of the logged-on user. Because Edge runs in a sandbox, the immediate gain is code execution in the browser process, with further impact depending on sandbox escape.

Attack surface

Reached over the network via a crafted web page or script that the Edge scripting engine parses. The CVSS vector shows no privileges required but user interaction required, meaning the victim must open or be directed to the malicious content.

Exploitation

A public exploit exists on Exploit-DB, and EPSS is high at 0.6546 (99.2nd percentile), but the CVE is not listed in CISA KEV, so there is no confirmed in-the-wild exploitation record in this data.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-11811.
• Upgrade or remove unsupported Windows 10 builds (Gold, 1511, 1607, 1703) that no longer receive fixes.
• Keep Edge and ChakraCore-based components current on all supported systems.
• Restrict browsing to trusted sites and block known exploit-hosting domains at the network edge.

Detection

• Monitor for Edge or ChakraCore process crashes followed by unexpected child processes, which can indicate exploitation attempts.
• Alert on suspicious script or HTML files delivered from external sources that trigger Edge rendering.
• Review endpoint telemetry for code execution originating from the browser process outside normal behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.