Microsoft · Microsoft Edge
A remote code execution flaw in Microsoft Edge's Chakra scripting engine stems from how the engine handles objects in memory, resulting in a memory corruption vulnerability that also affects ChakraCore. An attacker could execute arbitrary code by exploiting this memory handling flaw; the available record does not specify the required access, authentication, or user interaction conditions.
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2019-0539, CVE-2019-0567.
Public exploit code (Exploit-DB) appeared 10 days after disclosure. No confirmed exploitation is recorded.
8 fixes in Microsoft.ChakraCore over 4 months. The latest fix listed for Microsoft.ChakraCore is 1.11.7.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: Microsoft.ChakraCore.
Upgrade to 1.11.11 or later
Fixes this CVE and 44 other known vulnerabilities in this package (CVE-2016-0191, CVE-2016-0193, +42).
Set the version to 1.11.11 or later in your .csproj.
First fixed in 1.11.5 for CVE-2019-0568.
| If you run | Upgrade to |
|---|---|
| All versions before 1.11.5 | 1.11.11first fix for this CVE: 1.11.5 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.