CVE-2018-0838: Microsoft Edge and ChakraCore scripting engine memory corruption RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote code execution with a public exploit and very high EPSS, though exploitation requires user interaction and high attack complexity.

What it is

Microsoft Edge and ChakraCore mishandle objects in memory in the scripting engine, an out-of-bounds write (CWE-787) that corrupts memory. A remote attacker can trigger it through crafted content, leading to code execution in the browser or script host context. It affects Windows 10 (Gold, 1511, 1607, 1703, 1709) and Windows Server 2016.

Impact

Successful exploitation lets an attacker execute arbitrary code with the privileges of the affected process, typically the current user. That enables installation of malware, data theft, or further compromise of the host.

Attack surface

Reached over the network via crafted web content or script processed by Edge or ChakraCore; no credentials are required, but the victim must be induced to view the malicious content (UI:R). The CVSS vector is AV:N/AC:H/PR:N/UI:R, so exploitation requires user interaction and is rated high complexity.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.653, ~99th percentile) and a public Exploit-DB entry (44080) exists, indicating exploit code is available. No ransomware association is documented.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-0838.
• Upgrade or retire affected Windows 10 builds and Windows Server 2016 systems that cannot be patched.
• Keep Edge and ChakraCore current; where ChakraCore is embedded, update the host application.
• Restrict browsing to trusted sites and block untrusted script content at the network or email gateway.
• Run affected users with least privilege to limit the impact of code execution.

Detection

• Monitor for Edge or ChakraCore process crashes and abnormal memory-corruption crash patterns.
• Hunt for child processes spawned by browser or script host processes, which can indicate post-exploitation.
• Alert on known exploit artifacts or payloads tied to Exploit-DB 44080 in web or email traffic.
• Review proxy and endpoint logs for delivery of exploit pages to unpatched Windows 10 or Server 2016 hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.