CVE-2018-0980: Microsoft Edge Chakra Engine Out-of-Bounds Write RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityPublic exploit code and a very high EPSS score make exploitation likely, though the requirement for user interaction and the absence of KEV listing keep it below critical.

What it is

CVE-2018-0980 is a remote code execution flaw in the Chakra scripting engine used by Microsoft Edge and ChakraCore, caused by an out-of-bounds write (CWE-787) when handling objects in memory. An attacker who convinces a user to open a crafted page can corrupt memory and potentially execute code in the browser's context. It is one of several similar Chakra memory corruption issues patched in April 2018.

Impact

Successful exploitation gives the attacker code execution with the privileges of the affected process, typically the browser or a script host, which can lead to full system compromise depending on the sandbox and user rights.

Attack surface

Reached over the network via a crafted web page or script content rendered by Edge or ChakraCore; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), so a victim must be lured into viewing the malicious content.

Exploitation

A public exploit exists (Exploit-DB 44653) and EPSS is high at 0.66845 (99.257th percentile), but the CVE is not listed in CISA KEV and no ransomware use is documented.

What to do

• Apply the Microsoft security update referenced in the vendor advisory for Edge and ChakraCore.
• Keep Edge and any ChakraCore-based applications current with the latest cumulative updates.
• Restrict or block untrusted script content and untrusted sites through browser policy where feasible.
• Reduce user exposure by enforcing least privilege and keeping browser sandboxing enabled.

Detection

• Monitor for crashes or abnormal terminations of Microsoft Edge or ChakraCore processes.
• Hunt for exploit artifacts or known PoC signatures tied to Exploit-DB 44653 in web proxy or endpoint logs.
• Review browser and endpoint telemetry for suspicious script execution or memory corruption indicators on hosts running affected versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.