CVE-2018-0777: Microsoft Edge scripting engine memory corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution in a default browser with a public exploit and very high EPSS, though exploitation requires user interaction and no KEV listing exists.

What it is

Microsoft Edge and ChakraCore mishandle objects in memory in the scripting engine, an out-of-bounds write (CWE-787) that corrupts memory. A remote attacker can trigger it through crafted content, and successful exploitation runs arbitrary code in the context of the current user. It matters because the affected browser shipped by default on multiple Windows 10 and Windows Server 2016 builds.

Impact

An attacker gains arbitrary code execution with the privileges of the logged-in user, enabling data theft, installation of malware, or further host compromise. Because the flaw is in the browser's scripting engine, no elevation is needed beyond the user's own rights.

Attack surface

Reached over the network via a crafted web page or scripted content rendered by Edge; the CVSS vector shows no privileges required but user interaction required, meaning the victim must open or interact with the malicious content.

Exploitation

Not listed in CISA KEV, but a public Exploit-DB entry (43718) exists and EPSS is very high at 0.784 (99.6th percentile), indicating substantial real-world exploitation likelihood.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-0777 as the first action.
• Upgrade or remove unsupported Windows 10 builds (Gold, 1511, 1607, 1703, 1709) that no longer receive servicing.
• Keep Edge and ChakraCore current and enforce browser updates through managed patching.
• Restrict or block untrusted scripted content and consider disabling the legacy Edge/Chakra engine where it is not required.

Detection

• Hunt for Edge or ChakraCore processes spawning child processes such as cmd.exe, powershell.exe, or wscript.exe.
• Monitor for crashes in MicrosoftEdge.exe or ChakraCore.dll consistent with scripting engine memory corruption.
• Review proxy and DNS logs for access to known exploit-hosting or malvertising domains tied to this campaign.
• Correlate endpoint telemetry for unusual memory-write or exploit-mitigation events in browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.