CVE-2018-8288: Microsoft Scripting Engine Memory Corruption RCE in Browsers

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote code execution with a public exploit and very high EPSS, but exploitation requires user interaction and the flaw is patched.

What it is

CVE-2018-8288 is an out-of-bounds write (CWE-787) in the way the Microsoft scripting engine handles objects in memory, affecting ChakraCore, Internet Explorer 11 and Microsoft Edge. Successful exploitation corrupts memory and can lead to remote code execution in the context of the browsing user. It is one of a cluster of similar scripting engine flaws patched in July 2018.

Impact

An attacker who convinces a user to load crafted content can execute arbitrary code with the privileges of the logged-on user. Because the flaw is a memory corruption in the scripting engine, the attacker gains code execution rather than just a crash or information leak.

Attack surface

Reached over the network (AV:N) through a browser rendering malicious web content or a crafted document; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N). No authentication is needed, but the victim must open or view the attacker-controlled content.

Exploitation

A public exploit exists (Exploit-DB 45213) and EPSS is high at 0.69 (99th percentile), though the CVE is not listed in CISA KEV. No ransomware group use is documented in the record.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-8288 as the first action.
• Upgrade or retire Internet Explorer 11 and legacy Edge/ChakraCore components where the patch cannot be applied.
• Enforce script and content restrictions (block untrusted ActiveX/script sources) and keep browser and OS patching current.
• Reduce exposure by limiting browsing of untrusted sites and applying network filtering for known exploit hosts.

Detection

• Monitor for browser processes (iexplore.exe, MicrosoftEdge.exe, ChakraCore hosts) spawning unexpected child processes such as cmd.exe or powershell.exe.
• Hunt for crashes or abnormal terminations in scripting engine modules (e.g., jscript.dll, chakra.dll) correlated with web browsing.
• Review proxy and DNS logs for access to known exploit or malvertising domains tied to this CVE.
• Use EDR to flag memory corruption indicators and exploit-like behavior in browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.