CVE-2018-8617: Microsoft Edge Chakra Engine Out-of-Bounds Write RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5 with a public exploit and very high EPSS (99.15th percentile) make this a high-priority patching target despite no KEV listing.

What it is

CVE-2018-8617 is a remote code execution flaw in how the Chakra scripting engine handles objects in memory, classified as an out-of-bounds write (CWE-787). It affects Microsoft Edge and ChakraCore. Because the engine is reachable from web content, a memory corruption bug here can lead to code execution in the browser's context.

Impact

An attacker who successfully triggers the flaw can execute arbitrary code in the context of the affected browser or host process. This gives the attacker the same privileges as the running user, potentially leading to full system compromise.

Attack surface

The vulnerability is network-reachable (AV:N) and requires user interaction (UI:R), typically by visiting a crafted web page or opening malicious content that invokes the Chakra engine. No authentication is required (PR:N).

Exploitation

A public exploit exists (Exploit-DB 46202), and EPSS is high at 0.62483 (99.15th percentile), indicating elevated likelihood of exploitation. The CVE is not listed in CISA KEV.

What to do

• Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com) as the primary fix.
• If patching is delayed, restrict or disable use of Microsoft Edge and ChakraCore-based components where feasible.
• Enforce network-level controls and web filtering to block known malicious or untrusted sites that could deliver the exploit.
• Keep browser and scripting engine components current and monitor vendor advisories for related Chakra fixes.

Detection

• Monitor for crashes or abnormal process terminations in Microsoft Edge or ChakraCore-related processes.
• Look for suspicious child processes spawned by browser processes, which may indicate post-exploitation activity.
• Use endpoint detection to flag memory corruption indicators or exploit-like behavior in scripting engine processes.
• Review web proxy and DNS logs for access to known exploit-hosting domains or malicious URLs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.