CVE-2018-0953: Microsoft Edge and ChakraCore scripting engine memory corruption RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5, a public exploit, and very high EPSS make this a serious remote code execution risk despite the lack of KEV listing.

What it is

CVE-2018-0953 is a remote code execution flaw in the way the Microsoft Edge and ChakraCore scripting engine handles objects in memory, classified as an out-of-bounds write (CWE-787). Successful exploitation corrupts memory and can lead to arbitrary code execution in the context of the browser process. It is one of a large batch of similar scripting engine memory corruption issues patched by Microsoft in May 2018.

Impact

An attacker who exploits the flaw can execute arbitrary code on the victim's machine, typically with the privileges of the user running Edge. That enables malware installation, data theft, or further lateral movement from the compromised host.

Attack surface

The vulnerability is reached over the network through crafted web content rendered by the Edge scripting engine, with the CVSS vector indicating no privileges required but user interaction required (the victim must open or view the malicious page). No authentication is needed to deliver the attack.

Exploitation

A public exploit exists in Exploit-DB (44694), and EPSS is very high at roughly 0.668 with a 99.3 percentile, indicating elevated likelihood of exploitation activity. The CVE is not listed in CISA KEV, so there is no confirmed in-the-wild exploitation record in that dataset.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-0953 as the primary fix.
• Upgrade or retire ChakraCore-based components and ensure Edge is on a supported, fully patched build.
• Enforce browser hardening such as Enhanced Mitigation Experience Toolkit-style protections, ASLR and DEP, and disable unnecessary scripting features where feasible.
• Restrict users from browsing untrusted sites and block known malicious domains at the network perimeter.
• Consider application allowlisting and endpoint detection to limit post-exploitation code execution.

Detection

• Monitor for Edge or ChakraCore process crashes and abnormal child process creation from browser processes.
• Hunt for known exploit artifacts and shellcode patterns associated with Exploit-DB 44694 in memory or on disk.
• Alert on suspicious script or HTML content delivered from newly registered or low-reputation domains to browsers.
• Correlate browser process anomalies with subsequent command execution, persistence, or outbound C2 traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.