cbcvebase.
CVE-2018-8298
published 2018-07-11

CVE-2018-8298: A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption…

PriorityP184high7.5CVSS 3.1
AVNACHPRNUIRSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-03-17
Exploited in the wild
EPSS
75.34%
99.5th percentile
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.

Affected

6 ranges
VendorProductVersion rangeFixed in
microsoftchakracore< 1.10.11.10.1
microsoftchakracore
microsoftinternet_explorer
microsoftinternet_explorer
microsoftinternet_explorer
msrcchakracore

Detection & IOCsextracted from sources · hover to see the quote

commandlet object = {}; Intl.NumberFormat.apply(object); Intl.DateTimeFormat.apply(object); Intl.DateTimeFormat.prototype.formatToParts.apply(object);
  • Look for JavaScript calling both Intl.NumberFormat.apply() and Intl.DateTimeFormat.apply() on the same object, followed by Intl.DateTimeFormat.prototype.formatToParts.apply() — this is the exact PoC trigger sequence for the type confusion.
  • Vulnerability is triggered specifically in the ICU code path of Intl.js (not WinGlob). Target environments are Microsoft Edge using ICU — specifically tested on Microsoft Edge 42.17672.1000.0 and Microsoft EdgeHTML 17.17672.
  • The root cause is in ChakraCore Intl.js ICU initializer (InitializeNumberFormat / InitializeDateTimeFormat) which lacks a re-initialization guard, allowing the same object to be initialized multiple times and causing type confusion.
  • ·The vulnerability only affects ChakraCore builds using the ICU internationalization backend, not the WinGlob backend. Ensure detection logic targets ICU-enabled Edge/ChakraCore versions.
  • ·The fix is delivered as a commit in ChakraCore v1.10.1. Verify patched version is applied before deprioritizing detections.

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
ghsa7.5HIGH
osv7.5HIGH
vulncheck7.5HIGH
cisa7.5HIGH
vendor_msrc4.2MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.