CVE-2019-0567: Microsoft Edge Chakra engine out-of-bounds write enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRemote code execution in a widely deployed browser engine with a public exploit and very high EPSS, though mitigated by required user interaction and high attack complexity.

What it is

CVE-2019-0567 is an out-of-bounds write (CWE-787) in the Chakra scripting engine used by Microsoft Edge and ChakraCore, caused by improper handling of objects in memory. Successful exploitation allows remote code execution in the context of the affected browser or host process. The flaw is remotely reachable but requires user interaction and has high attack complexity per the CVSS vector.

Impact

An attacker who triggers the memory corruption can execute arbitrary code in the context of the Chakra engine, potentially leading to full compromise of the affected process or user session.

Attack surface

Reached over the network (AV:N) with no privileges required (PR:N), but user interaction is required (UI:R), typically by visiting a crafted web page or opening malicious content that invokes the Chakra engine. Attack complexity is rated high (AC:H), indicating a non-trivial memory layout or timing condition.

Exploitation

Not listed in CISA KEV, but a public Exploit-DB entry (46203) exists and EPSS is very high (0.80126, 99.6th percentile), indicating elevated real-world exploitation likelihood.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2019-0567.
• Upgrade or retire ChakraCore-based components and ensure Edge is fully patched.
• Enforce browser hardening such as disabling unnecessary scripting features and restricting untrusted content.
• Use network and endpoint controls to block known exploit delivery vectors and malicious pages.

Detection

• Monitor for crashes or abnormal process terminations in Edge/ChakraCore that may indicate memory corruption attempts.
• Hunt for exploit artifacts matching Exploit-DB 46203 in web proxy, IDS, or endpoint telemetry.
• Correlate browser process spawning unusual child processes or making unexpected network connections after page loads.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.