CVE-2018-0946: Microsoft Edge and ChakraCore scripting engine memory corruption RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote code execution with a public exploit and very high EPSS, though exploitation requires user interaction and no KEV listing or confirmed in-the-wild use is recorded.

What it is

CVE-2018-0946 is a remote code execution flaw in how the Microsoft Edge and ChakraCore scripting engine handles objects in memory, classified as a use-after-free and out-of-bounds write. An attacker who convinces a user to open a crafted page can corrupt memory and potentially execute code in the browser's context. It matters because Edge and ChakraCore are widely deployed and the flaw is remotely reachable with only user interaction.

Impact

Successful exploitation gives the attacker code execution in the context of the affected scripting engine, which can lead to full compromise of the browsing session and, depending on sandbox state, the underlying host. The record does not state whether the sandbox is bypassed, so the practical blast radius is uncertain.

Attack surface

Reached over the network via a crafted web page or content rendered by the Edge scripting engine; the CVSS vector shows no privileges required but user interaction required (UI:R), meaning the victim must open the malicious page. No authentication is needed.

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.52 (98.9th percentile) and a public Exploit-DB entry (44758) exists, indicating exploit code is available. No ransomware group usage is documented in the record.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-0946 as the first action.
• Upgrade or retire ChakraCore-based components and keep Edge fully patched.
• Enforce browser isolation or sandboxing for untrusted web content to limit code execution impact.
• Restrict or block untrusted sites and drive-by content through web filtering and proxy controls.
• Reduce reliance on legacy Edge/ChakraCore where supported alternatives exist.

Detection

• Monitor for Edge or ChakraCore crashes and abnormal process terminations that may indicate memory corruption attempts.
• Hunt for exploit artifacts matching Exploit-DB 44758 in proxy, IDS, or endpoint telemetry.
• Alert on suspicious child processes or script execution spawned from browser processes.
• Track access to known malicious or newly registered domains serving exploit pages via web logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.