CVE-2017-11873: Microsoft Edge and ChakraCore scripting engine memory corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5 with network reachability and high EPSS (0.69802, 99.3rd percentile) plus a public Exploit-DB entry make this a high-priority browser flaw, though user interaction and the absence of KEV listing temper it below critical.

What it is

Microsoft Edge and ChakraCore mishandle objects in memory in the scripting engine, producing a memory corruption condition (CWE-119). An attacker who gets a victim to load crafted content can corrupt memory and run code in the context of the current user. The flaw affects Windows 10 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server version 1709.

Impact

An attacker gains the same rights as the logged-in user, which on a typical workstation means code execution in the browser's security context. Because the vector is network-reachable with high confidentiality, integrity and availability impact, a successful exploit can lead to full compromise of the user's session and data.

Attack surface

Reached over the network through the scripting engine when Edge or a ChakraCore host processes attacker-controlled content; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), so a victim must open or view the crafted page or file. No authentication is needed.

Exploitation

Not listed in CISA KEV, but an Exploit-DB entry (43154) is referenced and EPSS is 0.69802 (99.3rd percentile), indicating a high likelihood of exploitation activity. The record does not state whether exploitation is confirmed in the wild.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-11873.
• Upgrade or retire unsupported Windows 10 builds (1511, 1607, 1703, 1709) and Windows Server 2016/1709 where feasible.
• Keep Edge and ChakraCore components current and enforce browser updates through managed patching.
• Reduce exposure by restricting browsing to trusted sites and blocking untrusted script content at the network or email gateway.
• Run users with least privilege so a scripting-engine compromise yields limited rights.

Detection

• Monitor for Edge or ChakraCore processes spawning child processes or making unexpected network connections.
• Hunt for crashes in Edge/ChakraCore (msedge.exe, ChakraCore.dll) correlated with visits to untrusted or newly registered domains.
• Review proxy and DNS logs for known exploit-hosting domains and for delivery of script-bearing content to browsers.
• Check endpoint telemetry for anomalous memory or code-execution behavior in browser processes on unpatched Windows 10 and Server 2016/1709 hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.