CVE-2018-8276: Medium severity Microsoft Edge vulnerability

Q: What does an attacker need to exploit this issue?

The vulnerability is remotely reachable and requires no privileges or complex attack conditions, but it does require user interaction. The available data does not specify the exact interaction required.

Q: Which deployments should be prioritized for review?

Prioritize systems using Microsoft Edge or the Microsoft.ChakraCore NuGet package, since these are the listed affected products. The data does not identify affected versions or whether any default configuration is vulnerable.

Q: What is the security impact if exploitation succeeds?

Successful exploitation bypasses Control Flow Guard in the Chakra scripting engine. The supplied vector indicates integrity impact is high, while confidentiality and availability impact are not indicated.

Published Jul 11, 2018

Updated

A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard (CFG) to be bypassed, aka "Scripting Engine Security Feature Bypass Vulnerability." This affects Microsoft Edge, ChakraCore.

Affected Software

7 affected componentsFixes available

nuget/Microsoft.ChakraCore<1.10.1

1.10.1

Microsoft Edge

Microsoft Windows 10=1709

Microsoft Windows 10=1803

All of the following

Microsoft Edge

Any of the following

Microsoft Windows 10=1709

Microsoft Windows 10=1803

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade nuget/Microsoft.ChakraCore to a version that resolves this vulnerability.
Fixed in 1.10.1

Event History

Jul 11, 2018

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

via NVD·12:29 AM

RemedyDescriptionSeverityAffected Software

May 13, 2022

Advisory Published

01:53 AM

Frequently Asked Questions

What does an attacker need to exploit this issue?

The vulnerability is remotely reachable and requires no privileges or complex attack conditions, but it does require user interaction. The available data does not specify the exact interaction required.

Which deployments should be prioritized for review?

Prioritize systems using Microsoft Edge or the Microsoft.ChakraCore NuGet package, since these are the listed affected products. The data does not identify affected versions or whether any default configuration is vulnerable.

What is the security impact if exploitation succeeds?

Successful exploitation bypasses Control Flow Guard in the Chakra scripting engine. The supplied vector indicates integrity impact is high, while confidentiality and availability impact are not indicated.

CVE-2018-8276: Medium severity Microsoft Edge vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which deployments should be prioritized for review?

What is the security impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which deployments should be prioritized for review?

What is the security impact if exploitation succeeds?