CVE-2018-0774: Microsoft Edge scripting engine memory corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote code execution in a widely used browser with a public exploit and very high EPSS, though exploitation requires user interaction and no KEV listing.

What it is

Microsoft Edge on Windows 10 1709 mishandles objects in memory within the scripting engine, an out-of-bounds write (CWE-787). A remote attacker can trigger memory corruption that leads to arbitrary code execution in the context of the current user. The flaw is one of a large batch of scripting engine memory corruption issues patched together in January 2018.

Impact

Successful exploitation lets an attacker run arbitrary code with the privileges of the logged-in user. Because Edge runs in the user's context, the attacker gains the user's access to data and any resources that user can reach.

Attack surface

Reached over the network via a crafted web page or content rendered by the Edge scripting engine. The CVSS vector shows no privileges required but user interaction required (UI:R), meaning the victim must open or interact with the malicious content.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.6787, ~99.3rd percentile) and a public Exploit-DB entry (43715) exists, indicating exploit code is publicly available.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-0774 as the first action.
• Upgrade or remove Windows 10 1709 systems that are past end of servicing so they receive current Edge and ChakraCore fixes.
• Enforce browser hardening: disable or restrict unnecessary scripting features and keep Edge/ChakraCore fully patched.
• Block or filter known exploit and malicious content at the network and email gateway layers.
• Reduce user exposure by limiting browsing to trusted sites and applying least privilege to user accounts.

Detection

• Monitor for Edge or ChakraCore process crashes and abnormal terminations that may indicate memory corruption attempts.
• Hunt for exploit artifacts matching public PoC (Exploit-DB 43715) in proxy, IDS/IPS and endpoint telemetry.
• Alert on suspicious child processes spawned by Edge (e.g., script interpreters, cmd, powershell) indicating post-exploitation.
• Review web proxy logs for traffic to known exploit-hosting or malvertising domains.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.