Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2018-8145: Microsoft Edge and Internet Explorer 11 Leaks Private Data
CVE-2018-8145 · published 8 years ago
Summary
A security flaw in Microsoft Edge and Internet Explorer 11 could allow an attacker to access sensitive information stored on your computer. This means that an attacker could potentially use this information to launch further attacks. We recommend updating your browser to the latest version to fix this issue.
What to do
- Update microsoft microsoft.chakracore to version 1.8.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| nuget | microsoft | microsoft.chakracore |
< 1.8.4 Fix: upgrade to 1.8.4
|
| – | microsoft | chakracore |
<= 1.8.3 cpe:2.3:a:microsoft:chakracore:*:*:*:*:*:*:*:* |
| – | microsoft | internet_explorer |
10 11 cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:* |
| – | microsoft | edge |
All versions
cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:* |
Original advisory text
An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user's compute...
An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user's computer or data, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge, Internet Explorer 10. This CVE ID is unique from CVE-2018-0943, CVE-2018-8130, CVE-2018-8133, CVE-2018-8177.
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-8145
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8145
- https://www.exploit-db.com/exploits/45011/
- https://web.archive.org/web/20210124164314/http://www.securityfocus.com/bid/1039...
- https://web.archive.org/web/20211204185256/http://www.securitytracker.com/id/104...
- https://github.com/advisories/GHSA-xphq-3x6q-q2qq
- http://www.securityfocus.com/bid/103986 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1040844 Third Party Advisory VDB Entry
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-200Information Exposure
Timeline
Published9 May 2018
Updated18 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta