Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2019-0607: Microsoft Edge can run attacker code remotely
CVE-2019-0607 · published 7 years ago
Summary
The web browser Microsoft Edge and its JavaScript engine, ChakraCore, may let a specially crafted web page cause the program to execute malicious code on your computer. This could give an attacker control over the system without your permission. Install the latest security updates for Edge as soon as they are released to protect your devices.
What to do
- Update microsoft chakracore to version 1.11.6 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | edge |
All versions
cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:* |
| microsoft | chakracore |
< 1.11.6 cpe:2.3:a:microsoft:chakracore:*:*:*:*:*:*:*:* |
Original advisory text
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is...
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0644, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.
References
- http://www.securityfocus.com/bid/106907 Third Party Advisory VDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0607 Patch Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-787Out-of-bounds Write
Timeline
Published5 Mar 2019
Updated17 Oct 2026
First seen29 Sep 2026
Sources
CVE-2019-0607 · NVD
Track software like this
Free during beta