cbcvebase.
CVE-2018-8133
published 2018-05-09

CVE-2018-8133: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting…

PriorityP278high7.5CVSS 3.0
AVNACHPRNUIRSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
50.50%
98.8th percentile
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0943, CVE-2018-8130, CVE-2018-8145, CVE-2018-8177.

Affected

16 ranges
VendorProductVersion rangeFixed in
microsoftchakracore<= 1.8.3
microsoftchakracore
microsoftinternet_explorer
microsoftinternet_explorer
msrcchakracore
msrcmicrosoft_edge_on_windows_10_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_for_x64-based_systems
msrcmicrosoft_edge_on_windows_10_version_1607_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_version_1607_for_x64-based_systems
msrcmicrosoft_edge_on_windows_10_version_1703_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_version_1703_for_x64-based_systems
msrcmicrosoft_edge_on_windows_10_version_1709_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_version_1709_for_x64-based_systems
msrcmicrosoft_edge_on_windows_10_version_1803_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_version_1803_for_x64-based_systems
msrcmicrosoft_edge_on_windows_server_2016

Detection & IOCsextracted from sources · hover to see the quote

commandarr[0] = 2.3023e-320;
  • The vulnerability is triggered via a type confusion in EntrySimpleObjectSlotGetter when accessing w.event on a cross-site window object while a Proxy's getPrototypeOf handler mutates the type of a float array (e.g., arr[0] = {}). Look for JIT-compiled code paths that call EntrySimpleObjectSlotGetter without a subsequent ImplicitCallFlags check.
  • Exploit PoC requires an iframe to obtain a cross-site contentWindow object. Detection should look for JavaScript that creates an iframe, accesses contentWindow, wraps an array in a Proxy with a getPrototypeOf trap, and then calls a JIT-warmed function that reads a property from the cross-frame window object.
  • ·The exploit is publicly disclosed (PoC on Exploit-DB) but Microsoft's advisory states it had NOT been exploited in the wild at time of patch release. Exploitation likelihood was rated 'More Likely' for the latest software release.
  • ·The vulnerability only affects Microsoft Edge (HTML-based) and ChakraCore. The fix was shipped in ChakraCore v1.8.4 and Windows cumulative updates KB4103721, KB4103731, KB4103727, KB4103716, KB4103723.

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
ghsa7.5HIGH
osv7.5HIGH
vulncheck7.5HIGH
vendor_msrc4.2MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.