cbcvebase.
CVE-2018-0934
published 2018-03-14

CVE-2018-0934: ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine…

PriorityP269high7.5CVSS 3.0
AVNACHPRNUIRSUCHIHAH
EXPLOIT
EPSS
66.47%
99.2th percentile
ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0872, CVE-2018-0873, CVE-2018-0874, CVE-2018-0930, CVE-2018-0931, CVE-2018-0933, CVE-2018-0936, and CVE-2018-0937.

Affected

13 ranges
VendorProductVersion rangeFixed in
microsoftchakracore< 1.8.21.8.2
msrcchakracore
msrcmicrosoft_edge_on_windows_10_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_for_x64-based_systems
msrcmicrosoft_edge_on_windows_10_version_1511_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_version_1511_for_x64-based_systems
msrcmicrosoft_edge_on_windows_10_version_1607_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_version_1607_for_x64-based_systems
msrcmicrosoft_edge_on_windows_10_version_1703_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_version_1703_for_x64-based_systems
msrcmicrosoft_edge_on_windows_10_version_1709_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_version_1709_for_x64-based_systems
msrcmicrosoft_edge_on_windows_server_2016

Detection & IOCsextracted from sources · hover to see the quote

urlhttps://github.com/Microsoft/ChakraCore/releases/tag/v1.8.2
  • CVE-2018-0934 PoC (EDB-44396) triggers the vulnerability by allocating a JavascriptNativeFloatArray's head segment on the heap (via sparse index assignment e.g. stack_arr[20] = 1.1) before passing the stack array to an inlined function, bypassing the BoxStackInstance deepCopy check. Detect JIT-compiled Edge/ChakraCore processes exhibiting stack-to-heap array copy followed by in-place type conversion (ConvertToVarArray).
  • CVE-2018-0934 PoC (EDB-44397) bypasses the incomplete fix by inserting 'new Error()' inside the inlined function to force BoxStackInstance to be called with deepCopy=false via the Error constructor's stack-walk, caching a shallow-copied array. Monitor for Edge/ChakraCore JIT scenarios where Error construction occurs inside heavily JIT-optimized inlined functions operating on sparse float arrays.
  • The vulnerability is exploitable via a web-based attack where an attacker hosts a specially crafted website targeting Microsoft Edge (HTML-based). Monitor for Edge processes spawning unexpected child processes or exhibiting privilege escalation following navigation to untrusted sites.
  • The root cause is in JavascriptArray::BoxStackInstance — specifically the conditional check 'if (ThreadContext::IsOnStack(instance->head))' which can be bypassed by pre-allocating the head segment to the heap. Detection should focus on anomalous memory corruption patterns in chakra.dll / ChakraCore during array boxing operations.
  • ·The -WERExceptionSupport flag is required when testing the PoC (EDB-44397) with the ChakraCore standalone shell (ch), but this flag is enabled by default in Microsoft Edge, meaning the bypass works out-of-the-box in the browser without any special configuration.
  • ·Microsoft's patch for the original issue (1420) introduced a 'deepCopy' parameter to BoxStackInstance, but the fix is incomplete — it only deep-copies when instance->head is on the stack, leaving a bypass path when head is pre-allocated to the heap.
  • ·The exploit status at time of patching was 'Publicly Disclosed: No; Exploited: No' but rated 'Exploitation More Likely' for the latest software release, indicating high exploitation risk post-disclosure.

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
ghsa7.5HIGH
osv7.5HIGH
vendor_msrc4.2MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.