CVE-2018-8355: Microsoft browser scripting engine memory corruption RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityA public exploit and very high EPSS score raise urgency, but the required user interaction and lack of KEV listing keep it below critical.

What it is

CVE-2018-8355 is a remote code execution flaw in how the scripting engine handles objects in memory in Microsoft browsers, classified as an out-of-bounds write (CWE-787). It affects ChakraCore, Internet Explorer 11 and Microsoft Edge, and a crafted page can corrupt memory in a way that leads to code execution in the browser's context.

Impact

An attacker who successfully exploits the flaw can execute arbitrary code with the privileges of the current user. Because the affected component is a browser scripting engine, that typically means code running in the user's session, with the impact bounded by the user's rights and browser sandbox.

Attack surface

The vector is network-reachable (AV:N) with no privileges required (PR:N) but user interaction required (UI:R), so the victim must visit or open attacker-controlled content that the scripting engine parses. No authentication is needed; the attack is delivered through browsing or rendering a malicious page.

Exploitation

A public exploit exists (Exploit-DB 45432), and EPSS is high at roughly 0.68 probability over 30 days (99th percentile), though the CVE is not listed in CISA KEV. The combination of a public exploit and high EPSS indicates active interest, but the record does not confirm observed in-the-wild exploitation.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-8355 as the first action.
• If patching cannot be immediate, restrict or disable use of Internet Explorer 11 and legacy scripting paths, and enforce a modern, fully patched browser.
• Keep ChakraCore-based components updated wherever they are embedded, not just the browser binaries.
• Reduce exposure by blocking untrusted script content and applying network or proxy filtering for known exploit hosts.
• Run browsers with least privilege and keep exploit mitigations (ASLR, DEP, sandboxing) enabled.

Detection

• Hunt for browser or scripting engine crashes and abnormal process terminations on endpoints running IE11, Edge or ChakraCore.
• Monitor for suspicious child processes spawned by browser processes, which can indicate successful exploitation.
• Review proxy and DNS logs for access to known exploit or malvertising infrastructure tied to this CVE.
• Alert on Exploit-DB 45432 signatures or matching exploit traffic if IDS/IPS rules are available.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.