CVE-2018-0774: Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles…

PriorityP269high7.5CVSS 3.0

AVNACHPRNUIRSUCHIHAH

EXPLOIT

EPSS

67.87%

99.2th percentile

Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0758, CVE-2018-0762, CVE-2018-0768, CVE-2018-0769, CVE-2018-0770, CVE-2018-0772, CVE-2018-0773, CVE-2018-0775, CVE-2018-0776, CVE-2018-0777, CVE-2018-0778, and CVE-2018-0781.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
microsoft	chakracore	< 1.7.6	1.7.6
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—
microsoft_corporation	microsoft_edge	—	—
msrc	chakracore	—	—
msrc	microsoft_edge_on_windows_10_version_1709_for_32-bit_systems	—	—
msrc	microsoft_edge_on_windows_10_version_1709_for_x64-based_systems	—	—

Detection & IOCsextracted from sources · hover to see the quote

urlhttps://github.com/Microsoft/ChakraCore/releases/tag/v1.7.6↗

command(function func(arg = function () { print(func); }()) { print(func); function func() { } })();↗

→Trigger condition is incorrect scope handling in Chakra's param scope during PostVisitFunction — look for JavaScript functions with default parameter expressions that reference the outer function name, combined with an inner function declaration of the same name. ↗
→Vulnerability is specific to Microsoft Edge (HTML-based) scripting engine (ChakraCore) on Windows 10 version 1709; scope detection to that platform/version combination. ↗
→Web-based delivery vector: monitor for users browsing to newly-registered or low-reputation sites from Edge on Windows 10 1709, particularly sites serving obfuscated JavaScript with nested function declarations sharing names with default-parameter expressions. ↗
→Also monitor compromised legitimate sites and ad-network content as a delivery mechanism for the exploit payload. ↗

·Exploit status is 'Publicly Disclosed: No; Exploited: No' at time of advisory, but rated 'Exploitation More Likely' for the latest software release — prioritise patching Windows 10 1709 systems running unpatched Edge/ChakraCore below v1.7.6. ↗
·The PoC from Exploit-DB (EDB-43715) is labelled 'Incorrect Scope Handling' and demonstrates the crash primitive only; it does not include a full weaponised payload, but its public availability raises the likelihood of weaponisation. ↗

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C

vendor_msrc4.2MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.