CVE-2018-0837: Microsoft Edge and ChakraCore scripting engine memory corruption RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5 with a public exploit and very high EPSS (99.2nd percentile) make this a serious remote code execution risk despite the High attack complexity and required user interaction.

What it is

CVE-2018-0837 is a memory corruption flaw (out-of-bounds write, CWE-787) in how the Microsoft Edge and ChakraCore scripting engines handle objects in memory. Successful exploitation allows remote code execution in the context of the affected browser or script host. It affects Windows 10 (Gold, 1511, 1607, 1703, 1709) and Windows Server 2016.

Impact

An attacker who exploits the flaw can execute arbitrary code in the context of the current user, potentially taking full control of the affected system. Because the flaw is in the scripting engine, code execution occurs within the browser or ChakraCore host process.

Attack surface

Reached remotely over the network (AV:N) with no privileges required (PR:N), but exploitation requires user interaction (UI:R), typically a victim visiting a crafted web page or opening malicious content that triggers the scripting engine. Attack complexity is rated High (AC:H).

Exploitation

A public exploit exists (Exploit-DB 44081), and EPSS is high at 0.653 (99.2nd percentile), indicating elevated likelihood of exploitation. The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is documented in this record.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-0837 as the primary fix.
• Upgrade or remove unsupported Windows 10 builds (Gold, 1511, 1607, 1703, 1709) that no longer receive security updates.
• Ensure ChakraCore-based applications are updated to a patched version or migrated off the vulnerable engine.
• Enforce browser hardening such as Enhanced Mitigation Experience Toolkit/Exploit Protection and disable unnecessary scripting where feasible.
• Restrict user browsing to trusted sites and block known exploit-hosting domains at the network layer.

Detection

• Monitor for crashes or abnormal termination of Microsoft Edge (MicrosoftEdge.exe) and ChakraCore host processes, which can indicate memory corruption attempts.
• Hunt for exploit-related network traffic or downloads matching known PoC patterns associated with Exploit-DB 44081.
• Review endpoint telemetry for suspicious child processes spawned by Edge or ChakraCore hosts, a common post-exploitation indicator.
• Track patch status of Windows 10 and Windows Server 2016 systems against the MSRC advisory to find unpatched assets.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.