CVE-2018-8298: ChakraCore scripting engine type confusion allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityNetwork-reachable remote code execution with a public exploit and KEV listing, though exploitation requires user interaction and high attack complexity.

What it is

ChakraCore mishandles objects in memory in a way that leads to type confusion (CWE-843), which the vendor classifies as a remote code execution vulnerability. Because the engine is used to parse and execute script content, a crafted page or script can corrupt memory and potentially run attacker-controlled code in the context of the affected process.

Impact

An attacker who successfully triggers the type confusion can execute arbitrary code with the privileges of the process running ChakraCore, typically the user or application hosting the engine.

Attack surface

The CVSS vector is network-reachable (AV:N) with no privileges required (PR:N) but user interaction required (UI:R), meaning a victim must open or load attacker-supplied script content. Attack complexity is rated High (AC:H), so reliable triggering is not trivial.

Exploitation

CVE-2018-8298 is listed in CISA KEV (added 2022-03-03) and has a public Exploit-DB entry (45217), indicating known exploitation in the wild; EPSS is 0.745 (99.5th percentile). No ransomware campaign use is documented.

What to do

• Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com advisory CVE-2018-8298) to all ChakraCore deployments.
• If ChakraCore is embedded in an application, update to the fixed engine build and rebuild/redeploy the host application.
• Restrict execution of untrusted script content and block known exploit delivery paths at the network and email layers.
• Where ChakraCore is not required, remove or disable the component to reduce exposure.
• Track KEV remediation deadlines (due 2022-03-17) and verify patched status across all instances.

Detection

• Monitor for crashes or abnormal process termination in applications hosting ChakraCore, which can indicate type confusion triggering.
• Hunt for known Exploit-DB 45217 payload patterns or related script content in web and email traffic.
• Alert on unexpected child processes or code execution spawned from ChakraCore-hosting processes.
• Audit installed ChakraCore versions against the vendor-fixed build and flag unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.