CVE-2018-0835: Microsoft Edge and ChakraCore scripting engine memory corruption RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw allows remote code execution with no authentication, public exploit code is referenced, and EPSS is very high, though exploitation requires user interaction and the affected OS versions are old.

What it is

CVE-2018-0835 is an out-of-bounds write (CWE-787) in how the Microsoft Edge and ChakraCore scripting engine handles objects in memory, leading to memory corruption. Microsoft classifies it as a remote code execution vulnerability, and it is one of a large batch of similar scripting engine flaws patched in February 2018. It matters because a memory-corruption bug in a browser engine can be turned into code execution in the context of the browsing user.

Impact

An attacker who successfully exploits the flaw can execute arbitrary code in the context of the current user. If that user has administrative rights, the attacker could take control of the affected system, including installing programs, viewing or changing data, and creating accounts.

Attack surface

The CVSS vector (AV:N/PR:N/UI:R) indicates the flaw is reachable over the network with no authentication but requires user interaction, consistent with a victim visiting a crafted web page or opening attacker-supplied content that triggers the scripting engine. No specific delivery vector beyond the browser/scripting engine is described in the record.

Exploitation

CISA KEV does not list this CVE, but EPSS is high (0.653 probability, 99.2nd percentile), and the references include an Exploit-DB entry tagged "Exploit," indicating public exploit code exists. The record does not state whether it has been observed in real-world attacks.

What to do

• Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com advisory CVE-2018-0835) to affected Windows 10 builds and Windows Server 2016.
• Update or retire ChakraCore-based components that embed the vulnerable scripting engine.
• Keep browsers and OS builds on supported, fully patched versions; the listed Windows 10 releases (Gold through 1709) are long out of support.
• Reduce exposure by restricting browsing to trusted sites and blocking untrusted script content where feasible, since exploitation requires user interaction.

Detection

• Hunt for crashes or abnormal terminations of MicrosoftEdge.exe, MicrosoftEdgeCP.exe, or ChakraCore-based processes on affected hosts.
• Monitor for browser processes spawning unexpected child processes (e.g., cmd.exe, powershell.exe) shortly after web browsing activity.
• Review proxy and DNS logs for access to known exploit-hosting or malvertising domains in the period around exploitation attempts.
• Correlate endpoint telemetry for memory-corruption indicators such as access violations in scripting engine modules with subsequent suspicious process creation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.