cbcvebase.
CVE-2018-8466
published 2018-09-13

CVE-2018-8466: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting…

PriorityP268high7.5CVSS 3.0
AVNACHPRNUIRSUCHIHAH
EXPLOIT
EPSS
69.02%
99.3th percentile
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8367, CVE-2018-8465, CVE-2018-8467.

Affected

25 ranges
VendorProductVersion rangeFixed in
microsoftchakracore<= 1.10.1
microsoftchakracore
microsoftmicrosoft_edge
microsoftmicrosoft_edge
microsoftmicrosoft_edge
microsoftmicrosoft_edge
microsoftmicrosoft_edge
microsoftmicrosoft_edge
microsoftmicrosoft_edge
microsoftmicrosoft_edge
microsoftmicrosoft_edge
microsoftmicrosoft_edge
microsoftmicrosoft_edge
msrcchakracore
msrcmicrosoft_edge_on_windows_10_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_for_x64-based_systems
msrcmicrosoft_edge_on_windows_10_version_1607_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_version_1607_for_x64-based_systems
msrcmicrosoft_edge_on_windows_10_version_1703_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_version_1703_for_x64-based_systems
msrcmicrosoft_edge_on_windows_10_version_1709_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_version_1709_for_x64-based_systems
msrcmicrosoft_edge_on_windows_10_version_1803_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_version_1803_for_x64-based_systems
msrcmicrosoft_edge_on_windows_server_2016

Detection & IOCsextracted from sources · hover to see the quote

commandarr['leng' + 'th'] = 0;
commandlet x_obj = document.body.appendChild(document.createElement('iframe')).contentWindow.eval('({})');
  • Detect cross-site (CrossSite vtable replacement) array type confusion in Chakra JIT: monitor for iframe-based cross-window object injection combined with array length manipulation via obfuscated property access (e.g., split string concatenation for 'length').
  • Look for JIT warm-up loops (~10000 iterations) followed by a final out-of-loop call with the same array — a classic JIT spray/type confusion pattern used to trigger the optimized (unchecked) code path.
  • Flag use of contentWindow.eval() on a cross-origin or same-page iframe to produce a cross-site object, which is the primitive used to replace the vtable and bypass BailOutOnInvalidatedArrayHeadSegment.
  • Monitor for in-place array type conversion triggered by assigning an object to a float array element (arr[1] = {}), which is the final step to achieve memory corruption after the JIT check bypass.
  • The vulnerability is specific to Microsoft Edge (HTML-based) with ChakraCore prior to v1.11.1; patch level detection should check for KB4457138, KB4457128, KB4457142, KB4457132, KB4457131.
  • ·Exploit status at time of patch release was 'Publicly Disclosed: No; Exploited: No' but rated 'Exploitation More Likely' for the latest software release — treat as high-priority for Edge/ChakraCore deployments.
  • ·This CVE is distinct from three related Chakra JIT vulnerabilities (CVE-2018-8367, CVE-2018-8465, CVE-2018-8467); rules targeting this specific vtable/BailOut bypass should not be conflated with those.

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
ghsa7.5HIGH
osv7.5HIGH
vendor_msrc4.2MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.