Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Microsoft Edge allows attackers to run malicious code or crash browser

CVE-2016-7190 · published 10 years ago
Summary

Microsoft Edge's JavaScript engine can be tricked into running unauthorized code or crashing if you visit a malicious website. This means that a hacker could potentially take control of your device by getting you to visit a specially crafted website. To protect yourself, keep your browser and operating system up to date with the latest security patches.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
nuget microsoft microsoft.chakracore <= 1.2.1
– microsoft edge All versions
cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*
Original advisory text
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memor...
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3386, CVE-2016-3389, and CVE-2016-7194.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.5 High
Exploitation
67% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published14 Oct 2016
Updated22 Sep 2026
First seen6 Mar 2026
Sources
GHSA-w4mj-xwvw-382f · GHSA
CVE-2016-7190 · NVD
Track software like this
Free during beta