CVE-2017-11861: Microsoft Edge scripting engine memory corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5 with a public exploit and very high EPSS, but exploitation requires user interaction and the flaw is confined to the browser sandbox.

What it is

Microsoft Edge and ChakraCore mishandle objects in memory in the scripting engine, causing a memory corruption condition (CWE-119). An attacker who gets a victim to load crafted content can corrupt memory and run code in the context of the browsing process. The flaw affects Edge on Windows 10 1607, 1703, 1709 and Windows Server 2016/1709.

Impact

Successful exploitation lets the attacker execute arbitrary code with the same rights as the current user. Because Edge runs in a sandbox, the immediate gain is code execution inside the browser process, not full system control.

Attack surface

Reached over the network through a web page or other content rendered by the Edge scripting engine. No authentication is required, but the CVSS vector (UI:R) indicates the victim must be induced to open the crafted content.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.642, 99.2nd percentile) and a public Exploit-DB entry (43153) exists, so working exploit code is publicly available.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-11861.
• Upgrade or remove unsupported Windows 10 builds (1607, 1703, 1709) and Windows Server 2016/1709 where feasible.
• Keep Edge and ChakraCore patched and enforce automatic updates on endpoints.
• Restrict browsing to trusted sites and block known exploit-hosting domains at the proxy or DNS layer.
• Run browsers with exploit mitigations enabled (ASLR, DEP, Control Flow Guard) and consider Enhanced Mitigation Experience Toolkit-style hardening.

Detection

• Monitor for Edge or ChakraCore process crashes (WerFault events) that cluster around browsing of untrusted sites.
• Hunt for child processes spawned by MicrosoftEdge.exe or browser subprocesses, which can indicate sandbox escape or post-exploitation.
• Alert on network requests to domains associated with the public Exploit-DB proof of concept and similar exploit kits.
• Review proxy and DNS logs for users reaching pages that host scripting-engine exploit code.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.