CVE-2017-8635: Microsoft Browser Scripting Engine Memory Corruption RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityHigh CVSS (7.5) remote code execution with a public exploit and very high EPSS, though user interaction and high attack complexity temper the rating below critical.

What it is

Microsoft Internet Explorer and Edge JavaScript engines mishandle objects in memory, causing a memory corruption condition (CWE-119) that can be triggered by crafted content. Successful exploitation lets code run in the context of the current user, so the flaw matters on any unpatched Windows system where these browsers are used.

Impact

An attacker gains arbitrary code execution with the privileges of the logged-in user, enabling data theft, installation of malware, or further host compromise. Impact is bounded by the user's rights, so administrative users face full system compromise.

Attack surface

Reached over the network via a crafted web page or content rendered by the affected browser's scripting engine. The CVSS vector shows no privileges required but user interaction required (UI:R), meaning the victim must open or view the malicious content; attack complexity is rated high (AC:H).

Exploitation

Not listed in CISA KEV, but a public Exploit-DB entry (42471) exists and EPSS is very high at 0.55883 (99th percentile), indicating elevated real-world exploitation likelihood. No ransomware group usage is documented in the record.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2017-8635 as the first action.
• Upgrade or migrate off the affected legacy browsers and unsupported Windows versions where feasible.
• Enforce EMET or Windows Defender Exploit Guard mitigations on systems that cannot be patched immediately.
• Restrict browsing to trusted sites and block untrusted script content via proxy or email filtering.
• Reduce user privileges so exploitation yields limited rights.

Detection

• Monitor for browser processes (iexplore.exe, MicrosoftEdge.exe) spawning child processes such as cmd.exe, powershell.exe, or script hosts.
• Alert on crashes or memory-corruption indicators in scripting engine modules (e.g., jscript.dll, chakra.dll) across endpoints.
• Hunt for known Exploit-DB 42471 payload patterns or shellcode delivery via web proxy and DNS logs.
• Correlate browser exploitation attempts with subsequent persistence or credential-access activity on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.