CVE-2018-8467: Microsoft Edge Chakra engine memory corruption RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote code execution with High CVSS impact and very high EPSS, though exploitation requires user interaction and no KEV listing.

What it is

CVE-2018-8467 is a remote code execution flaw in how the Chakra scripting engine handles objects in memory in Microsoft Edge and ChakraCore, classified as an out-of-bounds write (CWE-787). An attacker who convinces a user to open a crafted page can corrupt memory and execute code in the context of the browser. It matters because Edge is a widely deployed default browser and the flaw gives code execution, not just a crash.

Impact

Successful exploitation lets an attacker run arbitrary code with the privileges of the current user, enabling installation of malware, data theft or further lateral movement. The CVSS vector rates confidentiality, integrity and availability impact all High.

Attack surface

Reached over the network via a crafted web page or content rendered by the Chakra engine; the vector shows no privileges required but user interaction is required, meaning the victim must open the malicious page. No authentication is needed.

Exploitation

Not listed in CISA KEV, but a public Exploit-DB entry (45572) exists and EPSS is very high at 0.69 probability (99.3rd percentile), indicating elevated real-world exploitation likelihood.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-8467 as the first action.
• Upgrade or retire ChakraCore-based components and ensure Edge is on a supported, patched build.
• Enforce browser isolation or sandboxing and block untrusted script content where feasible.
• Reduce reliance on legacy Edge/Chakra by migrating users to a currently supported browser.
• Restrict user ability to browse untrusted sites and apply network filtering for known exploit hosts.

Detection

• Monitor for Edge or ChakraCore process crashes consistent with memory corruption, especially following visits to untrusted sites.
• Hunt for child processes spawned by the browser (e.g. script interpreters, cmd, powershell) that indicate post-exploitation.
• Review proxy and DNS logs for access to known exploit or malvertising domains tied to this CVE.
• Correlate endpoint telemetry for anomalous memory-write behavior or shellcode execution in browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.