CVE-2017-11840: Microsoft Edge and ChakraCore scripting engine memory corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5 with a public exploit and very high EPSS percentile, though exploitation requires user interaction and high attack complexity.

What it is

CVE-2017-11840 is a memory corruption flaw in how the ChakraCore scripting engine handles objects in memory, affecting Microsoft Edge and ChakraCore on Windows 10 and Windows Server 2016/1709. Successful exploitation lets an attacker execute code with the same rights as the current user, so impact scales with the privileges of whoever is browsing.

Impact

An attacker gains code execution in the context of the logged-in user, enabling data theft, further compromise of the host, or lateral movement if that user has elevated rights.

Attack surface

Reached over the network through a crafted web page or script processed by Edge or ChakraCore, requiring user interaction (UI:R) but no authentication (PR:N); the CVSS vector notes high attack complexity.

Exploitation

Not listed in CISA KEV, but EPSS is 0.59642 (99th percentile) and a public Exploit-DB entry (43183) exists, indicating exploit code is publicly available.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-11840.
• Upgrade or retire affected Windows 10 and Windows Server 2016/1709 systems that can no longer be patched.
• Restrict or disable Microsoft Edge and ChakraCore-based script execution where not required.
• Enforce least privilege so browsing occurs under non-administrative accounts.
• Block known exploit hosts and untrusted script content at the network and email layers.

Detection

• Monitor for Edge or ChakraCore process crashes and abnormal memory-corruption behavior on endpoints.
• Hunt for suspicious child processes spawned by browser processes (for example script interpreters or command shells).
• Review proxy and DNS logs for known exploit-hosting domains tied to public PoCs.
• Alert on unexpected outbound connections originating from browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.