CVE-2019-0568: Microsoft Edge Chakra engine out-of-bounds write allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.5 with network reachability, a public exploit, and very high EPSS, though user interaction and high attack complexity temper immediate urgency.

What it is

CVE-2019-0568 is a memory corruption flaw in the Chakra scripting engine used by Microsoft Edge and ChakraCore, caused by an out-of-bounds write (CWE-787) when handling objects in memory. Successful exploitation leads to remote code execution in the context of the affected process. It matters because the browser engine is a common target and the flaw is remotely reachable.

Impact

An attacker who convinces a user to open a crafted page can corrupt memory and potentially execute arbitrary code in the browser's context. This can lead to full compromise of the user's session and system depending on the process privileges.

Attack surface

Reached over the network via a malicious web page or content rendered by Microsoft Edge or ChakraCore; no authentication is required, but user interaction (opening the page) is needed per the CVSS vector AV:N/AC:H/PR:N/UI:R.

Exploitation

A public exploit exists (Exploit-DB 46205) and EPSS is high at 0.69455 (99.3rd percentile), but the CVE is not listed in CISA KEV, so active exploitation in the wild is not confirmed by that source.

What to do

• Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com) as the primary fix.
• Upgrade or migrate away from ChakraCore and legacy Edge to a supported, patched browser engine.
• Enforce browser isolation or application allowlisting to reduce exposure to untrusted web content.
• Disable or restrict legacy Edge/Chakra usage where it is not required for business operations.
• Monitor vendor advisories for any updated guidance on this CVE.

Detection

• Monitor for crashes or abnormal process terminations in Microsoft Edge or ChakraCore that may indicate memory corruption attempts.
• Use endpoint detection to flag suspicious script or browser behavior consistent with exploit delivery from web content.
• Review proxy and web logs for access to known exploit-hosting or malicious pages tied to this CVE.
• Track exploit-db and vendor advisories for updated exploit signatures and add them to detection content.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.