Vulnerability record · CVE-2018-8229 · published 14 June 2018
CVE-2018-8229: Microsoft Edge Chakra engine type confusion allows remote code execution
Microsoft · Edge
The Chakra scripting engine in Microsoft Edge and ChakraCore mishandles objects in memory, a type confusion (CWE-843) that can corrupt memory and lead to remote code execution. It matters because the browser engine is a common target and the flaw is remotely reachable, though exploitation requires a user to open crafted content.
Description
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8227.
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityRemote code execution in a widely deployed browser engine with public exploit code and very high EPSS, tempered by the required user interaction and high attack complexity.
What it is
The Chakra scripting engine in Microsoft Edge and ChakraCore mishandles objects in memory, a type confusion (CWE-843) that can corrupt memory and lead to remote code execution. It matters because the browser engine is a common target and the flaw is remotely reachable, though exploitation requires a user to open crafted content.
Impact
An attacker who successfully triggers the flaw can execute arbitrary code in the context of the affected browser or ChakraCore host, giving full control of the process and potentially the user's session.
Attack surface
Reached over the network by delivering a crafted web page or script that the Chakra engine parses; no authentication is required, but user interaction (opening the page) is needed per the CVSS vector AV:N/AC:H/PR:N/UI:R.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.71, 99th percentile) and a public Exploit-DB entry (45013) exists, indicating exploit code is available.
What to do
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-8229.
- Upgrade or remove unsupported ChakraCore deployments and keep Edge/Windows fully patched.
- Enforce browser isolation or block untrusted script execution where feasible.
- Reduce reliance on legacy Edge/Chakra by migrating to a currently supported browser engine.
Detection
- Monitor for crashes or abnormal process termination in MicrosoftEdge/ChakraCore processes.
- Hunt for exploit-db 45013 indicators and known Chakra exploitation patterns in endpoint telemetry.
- Alert on suspicious child processes or script interpreters spawned by the browser.
- Review proxy/web logs for delivery of known exploit pages to Edge clients.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/104369 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1041097 | Third Party AdvisoryVDB Entry |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8229 | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/45013/ | Third Party AdvisoryVDB Entry |
| http://www.securityfocus.com/bid/104369 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1041097 | Third Party AdvisoryVDB Entry |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8229 | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/45013/ | Third Party AdvisoryVDB Entry |
Track CVE-2018-8229 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-8229), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
