CVE-2018-0770: Microsoft Edge scripting engine memory corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution in a widely deployed browser with public exploit code and very high EPSS, though not in KEV and requiring user interaction.

What it is

Microsoft Edge and ChakraCore mishandle objects in memory in the scripting engine, an out-of-bounds write (CWE-787) that corrupts memory. A remote attacker can trigger it through crafted content and execute code in the context of the current user. The flaw affects Windows 10 Gold, 1511, 1607, 1703, 1709 and Windows Server 2016.

Impact

Successful exploitation gives the attacker arbitrary code execution with the privileges of the logged-in user. Because Edge runs in a sandbox, the immediate gain is user-level code execution, with further impact depending on additional escape techniques not described in this record.

Attack surface

Reached over the network via the browser's scripting engine, requiring user interaction (UI:R) such as visiting a crafted page; no authentication is needed (PR:N). Attack complexity is rated high (AC:H), consistent with the memory-corruption nature of the bug.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.784, 99.6th percentile) and a public Exploit-DB entry (44075) exists, indicating exploit code is available. No ransomware group use is documented.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-0770 on all affected Windows 10 and Windows Server 2016 systems.
• Upgrade or retire unsupported Windows 10 builds (Gold, 1511) that no longer receive security fixes.
• Keep Edge and ChakraCore patched and enforce automatic updates where possible.
• Reduce exposure by restricting browsing to trusted sites and blocking known exploit-hosting domains at the network edge.
• Run users without local administrator rights to limit the value of user-context code execution.

Detection

• Monitor for Edge or ChakraCore crashes and unexpected process terminations on endpoints, which can indicate memory-corruption attempts.
• Hunt for child processes spawned by Edge (for example script interpreters or command shells) that are unusual for normal browsing.
• Review proxy and DNS logs for access to known exploit-hosting or malicious domains serving crafted pages.
• Check endpoint telemetry for suspicious memory-write or exploit-mitigation bypass behavior in browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.