Microsoft · Edge
The Chakra JavaScript scripting engine in Microsoft Edge contains a memory corruption flaw that lives in the browser's scripting component. An attacker can exploit it remotely to execute arbitrary code or crash the browser by getting a user to visit a crafted web site, requiring no authentication and some user interaction.
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.
First seen exploited 2 months after disclosure. Public exploit code (Exploit-DB) appeared 8 days after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Drive-by via malicious web page
via a crafted web site
Browser scripting engine code execution
allows remote attackers to execute arbitrary code
Memory corruption causes application denial of service
cause a denial of service (memory corruption)
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: Microsoft.ChakraCore.
Upgrade to 1.11.11 or later
Fixes this CVE and 44 other known vulnerabilities in this package (CVE-2016-0191, CVE-2016-0193, +42).
Set the version to 1.11.11 or later in your .csproj.
First fixed in 1.2.2 for CVE-2016-7201.
| If you run | Upgrade to |
|---|---|
| All versions before 1.2.2 | 1.11.11first fix for this CVE: 1.2.2 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.