Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-8178: Edge, Internet Explorer and ChakraCore could run attacker code

CVE-2018-8178 · published 8 years ago

Summary

The web engines used by Microsoft Edge, Internet Explorer 11 and the ChakraCore component can be tricked into executing malicious code from a crafted web page. This could let an attacker take control of the affected computer. Install the latest security updates from Microsoft as soon as they are available to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	edge	All versions `cpe:2.3:a:microsoft:edge:-:::::::*`
microsoft	internet_explorer	11 `cpe:2.3:a:microsoft:internet_explorer:11:::::::*`
microsoft	chakracore	<= 1.8.3 `cpe:2.3:a:microsoft:chakracore::::::::`

Original advisory text

A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corruption Vulnerability." This affects ChakraCore, Internet ...

References

http://www.securityfocus.com/bid/104076 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1040844 Third Party Advisory VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8178 Patch Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.5 High

Exploitation

15% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published9 May 2018

Updated18 Oct 2026

First seen29 Sep 2026

Sources

CVE-2018-8178 · NVD

Track software like this

Free during beta