CVE-2019-0539: Microsoft Edge Chakra engine out-of-bounds write allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution with public exploit code and very high EPSS, though exploitation requires user interaction and no KEV listing.

What it is

The Chakra scripting engine in Microsoft Edge and ChakraCore mishandles objects in memory, producing an out-of-bounds write (CWE-787). A crafted page can corrupt memory and execute code in the browser's context, so the flaw matters for any user who browses untrusted content with an unpatched Edge or ChakraCore build.

Impact

An attacker who lands the exploit gains code execution at the privilege level of the browsing process, which can lead to full system compromise depending on the host configuration.

Attack surface

Reached over the network by a user visiting a malicious or compromised web page that triggers the scripting engine; the CVSS vector shows no privileges required but user interaction required (UI:R), so the victim must open the page.

Exploitation

Not listed in CISA KEV, but public exploit code exists in Exploit-DB (46203, 46204, 46485) and EPSS is very high at 0.829 (99.7th percentile), indicating strong likelihood of exploitation.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2019-0539.
• Update or retire ChakraCore-based applications that embed the engine.
• Move users to a supported browser and disable or restrict legacy Edge/Chakra usage where feasible.
• Enforce browser isolation or script blocking for untrusted sites to reduce exposure until patching is complete.

Detection

• Monitor for crashes or abnormal terminations of Microsoft Edge and ChakraCore processes on endpoints.
• Hunt for exploit artifacts matching the public Exploit-DB PoCs (46203, 46204, 46485) in proxy, IDS or endpoint logs.
• Alert on Edge/ChakraCore spawning child processes such as cmd.exe, powershell.exe or script hosts.
• Review web proxy logs for known exploit-hosting domains and drive-by pages delivering Chakra exploits.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.