CVE-2018-8355 Public exploit EPSS 67.9%

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…

Microsoft · ChakraCore

Summary

A memory corruption flaw in the scripting engine's handling of objects in memory affects Microsoft's ChakraCore component, which is part of Microsoft browsers including Internet Explorer 11 and Microsoft Edge. The available data does not specify the attack vector, authentication requirements, or user interaction needed, so an attacker's exact prerequisites cannot be confirmed; the flaw permits remote code execution.

Official description · CVE.org

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. This CVE ID is unique from CVE-2018-8353, CVE-2018-8359, CVE-2018-8371, CVE-2018-8372, CVE-2018-8373, CVE-2018-8385, CVE-2018-8389, CVE-2018-8390.

Breakdown

24.9 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 6/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Infect visitors through a malicious websiteT1189 · Drive-by CompromiseSource data3 general detection rules
- Trick a user into opening a fileT1204.002 · Malicious FileSource data39 general detection rules
What they do
- Hijack how programs load codeT1574 · Hijack Execution FlowSource data8 general detection rules
- Crash the applicationT1499.004 · Application or System ExploitationSource data3 general detection rules
What can follow

Public exploit code (Exploit-DB) appeared 34 days after disclosure. No confirmed exploitation is recorded.

Disclosed15 Aug 2018day 0
Public exploit codeExploit-DB18 Sep 2018+34 days

techniques

8 , grouped by in kill-chain order 8

Initial AccessTA0001

Drive-by Compromise T1189

MITRE CTID mapping of the CVE · how it is exploited

ExecutionTA0002

Malicious File T1204.002

MITRE CTID mapping of the CVE · how it is exploited

Hijack Execution Flow T1574 also Stealth

MITRE CTID mapping of the CVE · primary impact

PersistenceTA0003

Create Account T1136

MITRE CTID mapping of the CVE · follow-on activity

CollectionTA0009

Data from Local System T1005

MITRE CTID mapping of the CVE · follow-on activity

ImpactTA0040

Data Destruction T1485

MITRE CTID mapping of the CVE · follow-on activity

Application or System Exploitation T1499.004

MITRE CTID mapping of the CVE · primary impact

Data Manipulation T1565

MITRE CTID mapping of the CVE · follow-on activity

Detection

0 rules for this CVE · 93 general rules for its techniques

Rules for this CVE

0 that reference CVE-2018-8355 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Drive-by CompromiseT11893 general rules

Cross Site Scripting Stringshightest
Flash Player Update from Suspicious Locationhightest
Suspicious Browser Child Process - MacOSmediumtest

Malicious FileT1204.00239 general rules

Droppers Exploiting CVE-2017-11882criticalstable
Ursnif Malware C2 URL Patterncriticalstable
Exploit for CVE-2017-8759criticaltest
Potential Maze Ransomware Activitycriticaltest
File With Uncommon Extension Created By An Office Applicationhightest
Flash Player Update from Suspicious Locationhightest
GAC DLL Loaded Via Office Applicationshightest
HackTool - LittleCorporal Generated Maldoc Injectionhightest

All 39 on SigmaHQ ↗

Hijack Execution FlowT15748 general rules

Exploiting SetupComplete.cmd CVE-2019-1378hightest
Potential PrintNightmare Exploitation Attempthightest
Suspicious Printer Driver Empty Manufacturerhightest
DLL Execution Via Register-cimprovider.exemediumtest
Potential Initial Access via DLL Search Order Hijackingmediumtest
Potential Registry Persistence Attempt Via DbgManagedDebuggermediumtest
Regsvr32 DLL Execution With Uncommon Extensionmediumtest
Windows Spooler Service Suspicious Binary Loadinformationaltest

Application or System ExploitationT1499.0043 general rules

Create AccountT11363 general rules

ESXi Account Creation Via ESXCLImediumtest
AWS ElastiCache Security Group Createdlowtest
New Kubernetes Service Account Createdlowtest

Data from Local SystemT100514 general rules

OpenCanary - SMB File Open Requesthightest
Potential Conti Ransomware Database Dumping Activity Via SQLCmdhightest
SQLite Chromium Profile Data DB Accesshightest
SQLite Firefox Profile Data DB Accesshightest
VeeamBackup Database Credentials Dump Via Sqlcmd.EXEhightest
Script Interpreter Spawning Credential Scanner - Linuxhighexperimental
Script Interpreter Spawning Credential Scanner - Windowshighexperimental
Shai-Hulud NPM Package Malicious Exfiltration via Curlhighexperimental

All 14 on SigmaHQ ↗

Data DestructionT148520 general rules

Fsutil Suspicious Invocationhighstable
Potential BlackByte Ransomware Activityhightest
Potential File Overwrite Via Sysinternals SDeletehightest
Renamed Sysinternals Sdelete Executionhightest
AWS EFS Fileshare Mount Modified or Deletedmediumtest
Azure Device or Configuration Modified or Deletedmediumtest
Azure Kubernetes Network Policy Changemediumtest
Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deletedmediumtest

All 20 on SigmaHQ ↗

Data ManipulationT15653 general rules

Powershell Add Name Resolution Policy Table Rulehightest
AWS EC2 Disable EBS Encryptionmediumstable
Google Cloud Re-identifies Sensitive Informationmediumtest

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: Microsoft.ChakraCore.

NuGetMicrosoft.ChakraCoreGHSA-h8jq-5737-hpcf

Upgrade to 1.11.11 or later

Fixes this CVE and 44 other known vulnerabilities in this package (CVE-2016-0191, CVE-2016-0193, +42).

Set the version to 1.11.11 or later in your .csproj.

First fixed in 1.10.2 for CVE-2018-8355.

Affected versions

If you run	Upgrade to
All versions before 1.10.2	1.11.11first fix for this CVE: 1.10.2

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

4 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2022-4108

Microsoft Edge Chakra JIT - 'localeCompare' Type ConfusionEDB-45432 · dos · windows · 2018-09-18 · verified
Microsoft Edge Chakra JIT - 'localeCompare' Type ConfusionEDB-45432 · dos · windows · 2018-09-18 · verified

, 30 Oct 2026

67.9%Top 0.68%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.32%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9932 19.9/20

Threat reports0 reports 0.0/10

Public exploit code1 NVD reference tagged Exploit; 2 Exploit-DB entries; 1 advisory exploit reference 5.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total24.9

Record

Published: 15 Aug 2018
Modified: 5 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

How an attack unfolds

1How attackers get in

2What they do

3What can follow

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ExecutionTA0002

PersistenceTA0003

CollectionTA0009

ImpactTA0040

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

References

vdb-entry 2

x_refsource_CONFIRM 1

exploit 1

How attackers get in

What they do

What can follow

techniques