CVE-2018-8384: ChakraCore scripting engine type confusion allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.5 with high confidentiality, integrity and availability impact, public exploit code, and a very high EPSS score, though exploitation requires user interaction.

What it is

CVE-2018-8384 is a type confusion flaw (CWE-843) in how the Chakra scripting engine handles objects in memory, affecting ChakraCore and Microsoft Edge. Successful exploitation corrupts memory in a way that can lead to arbitrary code execution in the context of the affected process. It is one of several related Chakra memory corruption issues patched in the same cycle.

Impact

An attacker who convinces a user to load crafted content can execute arbitrary code in the scripting engine's process, giving them the ability to run code on the victim's machine. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reached over the network by delivering a malicious web page or script that the Chakra engine parses; the CVSS vector shows no privileges required but user interaction required, so the victim must open or visit the crafted content. No authentication is needed on the attacker's side.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.6211, 99th percentile) and a public Exploit-DB entry (45431) exists, indicating exploit code is publicly available. No ransomware group usage is documented in the record.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-8384 as the first action.
• Update or retire any product embedding ChakraCore to a fixed build, since the flaw affects ChakraCore itself.
• Keep Microsoft Edge and the underlying Windows scripting components fully patched.
• Reduce exposure by restricting browsing to trusted sites and blocking untrusted script content where feasible.

Detection

• Monitor for crashes or abnormal terminations of Edge/ChakraCore processes that could indicate memory corruption attempts.
• Hunt for process creation or child processes spawned by browser or scripting engine processes, which can indicate post-exploitation code execution.
• Review proxy and web logs for delivery of known exploit pages or payloads associated with this CVE.
• Track endpoint alerts for type confusion or memory corruption exploit patterns against Chakra-based components.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.