Vulnerability record · CVE-2020-0878 · published 11 September 2020
CVE-2020-0878: Microsoft browsers memory corruption remote code execution
Microsoft · Internet Explorer
Microsoft Internet Explorer, Edge and ChakraCore mishandle objects in memory, allowing memory corruption via an out-of-bounds write (CWE-787). A crafted web page can corrupt memory and run code in the context of the browsing user, so the flaw matters most where users browse untrusted content or run with administrative rights.
Description
<p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, the attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers, and then convince a user to view the website. The attacker could also take advantage of compromised websites, or websites that accept or host user-provided content or advertisements, by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically via an enticement in email or instant message, or by getting them to open an email attachment.</p> <p>The security update addresses the vulnerability by modifying how Microsoft browsers handle objects in memory.</p>
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Automated analysis
high priorityIt is listed in CISA KEV with known ransomware use, but the CVSS base score is only 4.2 and exploitation requires user interaction and high attack complexity.
What it is
Microsoft Internet Explorer, Edge and ChakraCore mishandle objects in memory, allowing memory corruption via an out-of-bounds write (CWE-787). A crafted web page can corrupt memory and run code in the context of the browsing user, so the flaw matters most where users browse untrusted content or run with administrative rights.
Impact
An attacker gains code execution with the rights of the current user; if that user is an administrator, the attacker can install programs, view or alter data, and create accounts with full rights.
Attack surface
Reached over the network through Microsoft browsers: the attacker hosts or injects a crafted page and must convince the user to visit it, so user interaction is required and no authentication is needed. The CVSS vector confirms network access, high attack complexity and required user interaction.
Exploitation
CISA added this to the Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware campaign use, indicating exploitation in the wild; EPSS is low at roughly 2.7 percent 30-day probability, and references are patch and vendor advisory only.
What to do
- Apply the Microsoft security update for CVE-2020-0878 to Internet Explorer, Edge and ChakraCore systems, prioritizing any that are past the CISA due date of 2022-05-03.
- Retire or restrict Internet Explorer and legacy Edge/ChakraCore where business use allows, since the flaw is in the browser engine.
- Enforce browsing with least privilege so users do not run as local administrators, limiting the impact of code execution.
- Block or filter untrusted web content and email links/attachments that lead users to attacker-controlled pages, and keep users trained on such lures.
Detection
- Hunt for browser processes (iexplore.exe, msedge.exe) spawning unexpected child processes such as script interpreters or command shells.
- Monitor for crashes or memory-corruption indicators in browser processes on endpoints that visit newly registered or low-reputation domains.
- Review proxy and DNS logs for access to known exploit-hosting or malvertising domains tied to browser exploitation campaigns.
- Check patch and inventory data for unpatched Internet Explorer, Edge or ChakraCore installations against the vendor advisory.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2020-0878 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "Microsoft Edge and Internet Explorer Memory Corruption Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply updates per vendor instructions. Federal deadline 3 May 2022.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0878 | PatchVendor Advisory |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0878 | PatchVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0878 | US Government Resource |
Track CVE-2020-0878 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-0878), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
