CVE-2018-0860

published 2018-02-15

CVE-2018-0860: Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the…

Priority P2 68 high 7.5 CVSS 3.0

AV N AC H PR N UI R S U C H I H A H

EXPLOIT

Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0861, and CVE-2018-0866.

Affected

16 ranges

Vendor	Product	Version range	Fixed in
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—
microsoft_corporation	internet_explorer	—	—
msrc	chakracore	—	—
msrc	microsoft_edge_on_windows_10_for_32-bit_systems	—	—
msrc	microsoft_edge_on_windows_10_for_x64-based_systems	—	—
msrc	microsoft_edge_on_windows_10_version_1511_for_32-bit_systems	—	—
msrc	microsoft_edge_on_windows_10_version_1511_for_x64-based_systems	—	—
msrc	microsoft_edge_on_windows_10_version_1607_for_32-bit_systems	—	—
msrc	microsoft_edge_on_windows_10_version_1607_for_x64-based_systems	—	—
msrc	microsoft_edge_on_windows_10_version_1703_for_32-bit_systems	—	—
msrc	microsoft_edge_on_windows_10_version_1703_for_x64-based_systems	—	—
msrc	microsoft_edge_on_windows_10_version_1709_for_32-bit_systems	—	—
msrc	microsoft_edge_on_windows_10_version_1709_for_x64-based_systems	—	—
msrc	microsoft_edge_on_windows_server_2016	—	—

Detection & IOCs extracted from sources · hover to see the quote

url https://github.com/Microsoft/ChakraCore/releases/tag/v1.7.8↗

• → Look for JavaScript that defines a getter on Array.prototype using Object.prototype.valueOf, which is the core exploit primitive — this causes a JIT-optimized function to return a stack-allocated array object through an implicit call that should have been suppressed. ↗
• → The exploit pattern involves a tight loop (≥0x10000 iterations) to JIT-compile a function that accesses a non-existent property on a local array, followed by triggering the getter post-optimization — monitor for high-iteration loops combined with Array.prototype getter manipulation in Edge/ChakraCore JS. ↗
• → The vulnerability is triggered when ChakraCore's JIT engine calls a function marked HasNoSideEffect (e.g., Object.prototype.valueOf) even when DisableImplicitCall flag is set, leaking a stack-allocated object — detection should focus on valueOf being used as a getter on Array.prototype in Microsoft Edge. ↗

• · The exploit is specific to Microsoft Edge (HTML-based) and ChakraCore's JIT compiler; the memory corruption only manifests after the target function has been JIT-compiled (requires sufficient warm-up iterations), so sandboxed or non-JIT execution paths are not affected. ↗
• · Exploit status at time of patching was 'Publicly Disclosed: No; Exploited: No' but rated 'Exploitation More Likely' for the latest software release — prioritize patching accordingly. ↗

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 7.6 HIGH AV:N/AC:H/Au:N/C:C/I:C/A:C

ghsa 7.5 HIGH

osv 7.5 HIGH

vendor_msrc 4.2 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-787