CVE-2018-8145: Chakra scripting engine memory disclosure in Edge and IE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.5 with high EPSS and public exploit code, but exploitation requires user interaction and the flaw is information disclosure rather than direct code execution.

What it is

Chakra, the scripting engine used by ChakraCore, Internet Explorer 10/11 and Microsoft Edge, improperly discloses the contents of its memory. The flaw is an information exposure (CWE-200) that leaks memory contents an attacker can use to prepare further compromise of the user's system or data. It is one of several related Chakra issues patched in May 2018.

Impact

An attacker gains disclosure of memory contents from the browser process, which can reveal pointers and other data useful for defeating mitigations in a follow-on exploit. The record does not describe code execution from this flaw alone.

Attack surface

Reached over the network through crafted script or web content processed by the Chakra engine in Edge, IE 10/11 or ChakraCore. The CVSS vector shows no privileges required but user interaction required (UI:R), so a victim must open or view the malicious content.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.67 probability, 99.3rd percentile) and a public Exploit-DB entry (45011) exists, indicating public exploit code is available. No ransomware group use is documented.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-8145 across Edge, IE 10/11 and ChakraCore.
• Retire or restrict Internet Explorer 10/11 where possible and standardize on a supported, patched browser.
• Keep ChakraCore-based applications on a supported release and track upstream fixes.
• Enforce browser exploit mitigations and block untrusted script or web content through network and email filtering.

Detection

• Monitor for crashes or abnormal terminations of Edge, IE or ChakraCore processes that could indicate memory-disclosure attempts.
• Hunt for known public exploit code or related indicators tied to Exploit-DB 45011 in endpoint and network telemetry.
• Review proxy and DNS logs for delivery of exploit pages to browsers running unpatched Chakra versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.