CVE-2018-0775: Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles…

PriorityP269high7.5CVSS 3.0

AVNACHPRNUIRSUCHIHAH

EXPLOIT

EPSS

67.87%

99.2th percentile

Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0758, CVE-2018-0762, CVE-2018-0768, CVE-2018-0769, CVE-2018-0770, CVE-2018-0772, CVE-2018-0773, CVE-2018-0774, CVE-2018-0776, CVE-2018-0777, CVE-2018-0778, and CVE-2018-0781.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
microsoft	chakracore	< 1.7.6	1.7.6
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—
microsoft_corporation	microsoft_edge	—	—
msrc	chakracore	—	—
msrc	microsoft_edge_on_windows_10_version_1709_for_32-bit_systems	—	—
msrc	microsoft_edge_on_windows_10_version_1709_for_x64-based_systems	—	—

Detection & IOCsextracted from sources · hover to see the quote

commandeval(`(function f() { with ({}) { (function () { print(f); })(); } }());` + '\n'.repeat(0x1000))↗

command./ch poc.js -ForceDeferParse↗

→The vulnerability is triggered when the Chakra 'DeferParse' flag is enabled, either via the runtime flag -ForceDeferParse or by padding eval'd code with '\n'.repeat(0x1000) to force deferred parsing. Monitor for large eval payloads with excessive newline padding in Edge/Chakra scripting contexts. ↗
→Exploitation requires use of a 'with' statement combined with a nested function referencing an outer named function expression — flag JavaScript containing 'with ({})' blocks inside named function expressions as suspicious in Edge traffic. ↗
→Attack vector is web-based: attacker hosts or compromises a website to serve specially crafted content targeting Microsoft Edge (HTML-based). Monitor for drive-by download patterns and suspicious Edge network requests to newly registered or low-reputation domains. ↗

·The PoC exploit (Exploit-DB 43717) is specifically for the Chakra JavaScript engine's deferred parsing code path. The vulnerability is only triggerable when the DeferParse optimization is active, meaning exploitation conditions depend on script size/structure or explicit flag usage. ↗
·At time of advisory publication, the vulnerability had been publicly disclosed but was NOT confirmed exploited in the wild. Exploitation was rated 'More Likely' for the latest software release. ↗

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C

vendor_msrc4.2MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.