Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.2
CVE-2020-17048: Firefox Browser: Memory Corruption from Malicious Web Content
CVE-2020-17048 · published 5 years ago
Summary
The Chakra scripting engine in Firefox can be tricked into crashing or running unintended code, potentially allowing attackers to access sensitive information or take control of the browser. This vulnerability affects users who browse the web using Firefox. To stay safe, apply the latest security updates to your browser software.
What to do
- Update microsoft microsoft.chakracore to version 1.11.23.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| nuget | microsoft | microsoft.chakracore |
< 1.11.23 Fix: upgrade to 1.11.23
|
| – | microsoft | edge |
All versions
cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:* |
| – | microsoft | chakracore |
All versions
cpe:2.3:a:microsoft:chakracore:-:*:*:*:*:*:*:* |
Original advisory text
Chakra Scripting Engine Memory Corruption Vulnerability
Chakra Scripting Engine Memory Corruption Vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-17048
- https://github.com/chakra-core/ChakraCore/pull/6528
- https://github.com/chakra-core/ChakraCore/pull/6528/commits/90e222e9a9ba64bd8086...
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1704...
- https://github.com/advisories/GHSA-vpc2-7xmf-ppmf
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
4.2
Medium
Type
CWE-787Out-of-bounds Write
Timeline
Published11 Nov 2020
Updated3 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta