CVE-2018-0776: Microsoft Edge scripting engine memory corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 7.5 with a public exploit and very high EPSS make exploitation likely, though the high attack complexity and required user interaction temper the rating below critical.

What it is

Microsoft Edge and ChakraCore mishandle objects in memory in the scripting engine, an out-of-bounds write (CWE-787) that corrupts memory. A remote attacker who gets a user to open crafted content can run code in the context of the current user. The flaw affects Edge on Windows 10 Gold, 1511, 1607, 1703, 1709 and Windows Server 2016.

Impact

Successful exploitation gives the attacker code execution at the privilege level of the logged-in user, enabling data theft, installation of malware or further lateral movement within that user's rights.

Attack surface

Reached over the network through crafted web content rendered by the Edge scripting engine; no authentication is required but user interaction (opening or viewing the page) is needed per the CVSS vector AV:N/AC:H/PR:N/UI:R.

Exploitation

Not listed in CISA KEV, but a public Exploit-DB entry (43723) exists and EPSS is very high at 0.784 (99.6th percentile), indicating strong likelihood of exploitation activity.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-0776 as the first action.
• Upgrade or retire unsupported Windows 10 builds (Gold, 1511, 1607, 1703, 1709) that no longer receive fixes.
• Reduce reliance on Edge/ChakraCore for untrusted web content where feasible, and keep the browser and OS fully patched.
• Enforce least privilege so a compromised user session cannot escalate or persist broadly.

Detection

• Monitor for Edge or ChakraCore crashes and abnormal process terminations that may indicate memory corruption attempts.
• Hunt for suspicious child processes spawned by Edge (browser or script engine) such as command shells or scripting hosts.
• Review proxy and DNS logs for known exploit-hosting or malvertising domains delivering Edge exploit pages.
• Alert on exploit-db or public PoC signatures matching CVE-2018-0776 in network or endpoint telemetry.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.