Vulnerability record · CVE-2018-8466 · published 13 September 2018
CVE-2018-8466: Microsoft Edge Chakra engine out-of-bounds write allows remote code execution
Microsoft · Chakracore
The Chakra scripting engine in Microsoft Edge and ChakraCore mishandles objects in memory, producing an out-of-bounds write (CWE-787). A crafted page can corrupt memory and execute code in the browser's context, so the flaw matters for any environment still running these engines.
Description
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8367, CVE-2018-8465, CVE-2018-8467.
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 7.5 with high confidentiality, integrity and availability impact, plus public exploit code and a very high EPSS score, though exploitation requires user interaction and high attack complexity.
What it is
The Chakra scripting engine in Microsoft Edge and ChakraCore mishandles objects in memory, producing an out-of-bounds write (CWE-787). A crafted page can corrupt memory and execute code in the browser's context, so the flaw matters for any environment still running these engines.
Impact
An attacker who gets the victim to load a malicious page can run arbitrary code with the privileges of the Edge or ChakraCore process, typically the logged-in user.
Attack surface
Reached over the network through a crafted web page or script processed by the Chakra engine. No authentication is needed, but the CVSS vector requires user interaction (UI:R) and rates attack complexity as high (AC:H).
Exploitation
Not listed in CISA KEV, but EPSS is 0.69019 (99.3rd percentile) and an Exploit-DB entry (45571) exists, indicating public exploit code is available.
What to do
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-8466.
- Move users off Edge/ChakraCore builds that are no longer supported or patched.
- Restrict browsing to trusted sites and block known exploit-hosting domains at the proxy or DNS layer.
- Keep browser and OS patch levels current so related Chakra memory-corruption fixes are present.
Detection
- Monitor for Edge or ChakraCore process crashes consistent with memory corruption, especially following visits to untrusted sites.
- Alert on child processes spawned by the browser (for example script interpreters or command shells) that are not part of normal browsing.
- Hunt proxy and DNS logs for requests to domains associated with the public exploit for this CVE.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/105243 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1041623 | Third Party AdvisoryVDB Entry |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8466 | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/45571/ | Third Party AdvisoryVDB Entry |
| http://www.securityfocus.com/bid/105243 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1041623 | Third Party AdvisoryVDB Entry |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8466 | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/45571/ | Third Party AdvisoryVDB Entry |
Track CVE-2018-8466 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-8466), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
