CVE-2018-8276: Medium severity Microsoft Edge vulnerability
A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard (CFG) to be bypassed, aka "Scripting Engine Security Feature Bypass Vulnerability." This affects Microsoft Edge, ChakraCore.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nuget/Microsoft.ChakraCoreto a version that resolves this vulnerability.Fixed in 1.10.1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The vulnerability is remotely reachable and requires no privileges or complex attack conditions, but it does require user interaction. The available data does not specify the exact interaction required.
Which deployments should be prioritized for review?
Prioritize systems using Microsoft Edge or the Microsoft.ChakraCore NuGet package, since these are the listed affected products. The data does not identify affected versions or whether any default configuration is vulnerable.
What is the security impact if exploitation succeeds?
Successful exploitation bypasses Control Flow Guard in the Chakra scripting engine. The supplied vector indicates integrity impact is high, while confidentiality and availability impact are not indicated.