CVE-2018-0834: Microsoft Edge and ChakraCore scripting engine out-of-bounds write RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5 with public exploit code and very high EPSS, but exploitation requires user interaction and the flaw is not in CISA KEV.

What it is

Microsoft Edge and ChakraCore mishandle objects in memory in the scripting engine, leading to an out-of-bounds write (CWE-787) that can corrupt memory. A remote attacker can exploit this to execute code in the context of the browser or script host. It affects Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016.

Impact

Successful exploitation gives the attacker remote code execution at the privilege level of the affected process, typically the browser or script host. This can lead to full compromise of the user's session and data.

Attack surface

The flaw is reached over the network (AV:N) by delivering crafted content that the scripting engine processes, such as a malicious web page or script. User interaction is required (UI:R) because the victim must open or view the crafted content, and no authentication is needed (PR:N).

Exploitation

An Exploit-DB entry (44078) indicates public exploit code exists, and EPSS is high at 0.549 (98.9th percentile), though the CVE is not listed in CISA KEV. No ransomware group use is documented.

What to do

• Apply the Microsoft security update for CVE-2018-0834 as soon as possible.
• Upgrade or remove unsupported Windows 10 builds (Gold, 1511) that no longer receive fixes.
• Keep Edge and ChakraCore patched and avoid running untrusted scripts in the affected engine.
• Enforce browser isolation or application allowlisting to limit script execution from untrusted sources.

Detection

• Monitor for crashes or abnormal memory errors in Edge/ChakraCore processes.
• Hunt for known exploit artifacts or shellcode patterns associated with Exploit-DB 44078.
• Review proxy and endpoint logs for delivery of crafted pages or scripts targeting the scripting engine.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.