CVE-2018-0934: Microsoft Chakra Scripting Engine Memory Corruption RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5 and very high EPSS (99.2nd percentile) with public exploit code indicate a serious remote code execution risk, though user interaction is required and KEV does not list it.

What it is

CVE-2018-0934 is a memory corruption flaw in the Chakra scripting engine used by Microsoft Edge and ChakraCore, caused by improper handling of objects in memory (out-of-bounds write). It affects Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016, and allows remote code execution. The flaw matters because a crafted page can corrupt memory in the scripting engine and potentially execute code in the context of the browser.

Impact

An attacker who successfully exploits the flaw can execute arbitrary code in the context of the affected browser or ChakraCore host process. This can lead to full compromise of the user's session and, depending on privileges, the underlying system.

Attack surface

The vulnerability is reached over the network via a crafted web page or script processed by the Chakra engine; the CVSS vector indicates no privileges are required but user interaction is required (UI:R), meaning a victim must open or interact with the malicious content. No authentication is needed.

Exploitation

Public exploit code is referenced in Exploit-DB entries, and EPSS is high (0.66232, 99.243rd percentile), indicating elevated likelihood of exploitation activity. The CVE is not listed in CISA KEV, so there is no confirmed evidence of exploitation in the wild from that source.

What to do

• Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com) as the primary fix.
• Upgrade or migrate off unsupported Windows 10 builds (Gold, 1511, 1607, 1703, 1709) and keep Windows Server 2016 fully patched.
• If ChakraCore is embedded in applications, update it to a fixed version or remove/disable the scripting component where not required.
• Enforce browser hardening and network controls that block or restrict untrusted script content, and keep Edge/Internet Explorer patched.
• Monitor vendor advisories for related Chakra engine CVEs (CVE-2018-0872, -0873, -0874, -0930, -0931, -0933, -0936, -0937) and patch them together.

Detection

• Monitor for crashes or abnormal terminations of Microsoft Edge, ChakraCore-based processes, or script hosts that could indicate memory corruption attempts.
• Use endpoint detection to flag suspicious child processes spawned by browser or script host processes, which may indicate post-exploitation activity.
• Review proxy and DNS logs for known exploit delivery patterns or domains associated with public exploit code for this CVE.
• Track Exploit-DB references (44396, 44397) and threat intel feeds for exploitation attempts targeting Chakra engine memory corruption.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.