CVE-2018-8291: Microsoft browser scripting engine type confusion allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote code execution in widely deployed browsers with public exploit code and very high EPSS, though exploitation requires user interaction and no KEV listing.

What it is

A type confusion flaw in the scripting engine (ChakraCore) used by Internet Explorer 11, Microsoft Edge and ChakraCore causes memory corruption when objects are handled in memory. Because the corruption occurs in the JavaScript engine, it can be turned into remote code execution in the browser process. The record does not list specific affected versions beyond the three named products.

Impact

An attacker who gets a victim to load crafted content can corrupt memory and execute arbitrary code in the context of the browser, typically leading to full compromise of the user's session and machine.

Attack surface

Reached over the network through a web page or other content rendered by the affected browser; the CVSS vector shows no privileges required but user interaction required, so the victim must open or view the malicious content.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.69009, 99.3rd percentile) and a public Exploit-DB entry (45215) exists, indicating working exploit code is available.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-8291 as the first action.
• Retire or disable Internet Explorer 11 and legacy ChakraCore-based rendering where business use allows.
• Keep Edge and all browser components on current supported builds.
• Enforce script and content restrictions (blocking untrusted sites, disabling unnecessary scripting) to reduce exposure until patching completes.

Detection

• Monitor browser processes (iexplore.exe, MicrosoftEdge.exe) for unexpected child processes or script interpreters.
• Hunt for crashes in the scripting engine (chakra.dll) correlated with browsing of untrusted sites.
• Review proxy and DNS logs for known exploit-hosting domains and drive-by pages delivering browser exploits.
• Use EDR to flag memory-protection events or anomalous code execution originating from browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.