VYPR
← All advisories
High severityNVD Advisory· Published Mar 14, 2018· Updated Sep 17, 2024

CVE-2018-0937

CVE-2018-0937

Description

ChakraCore and Microsoft Edge on Windows 10 1703/1709 contain a memory corruption vulnerability in the Chakra scripting engine that allows remote code execution when a user visits a crafted webpage.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

ChakraCore and Microsoft Edge on Windows 10 1703/1709 contain a memory corruption vulnerability in the Chakra scripting engine that allows remote code execution when a user visits a crafted webpage.

Vulnerability

CVE-2018-0937 is a memory corruption vulnerability in the Chakra scripting engine used by ChakraCore and Microsoft Edge on Windows 10 version 1703 and 1709. The bug occurs when the engine improperly handles objects in memory, leading to exploitable corruption. Affected software includes all versions of ChakraCore and Microsoft Edge running on the listed Windows 10 builds. [1][2]

Exploitation

An attacker must craft a malicious webpage that, when visited by a victim using an affected browser, triggers the memory handling error. No additional authentication or local access is required; the attack is fully remote. The victim only needs to load the content (e.g., via a link or hosted page) to trigger the corruption [2][3].

Impact

Successful exploitation grants the attacker the ability to execute arbitrary code within the context of the current user. This can lead to full system compromise, including installation of programs, modification of data, or creation of accounts with full user rights. The vulnerability also potentially enables disclosure of sensitive information [3].

Mitigation

Microsoft released security updates on March 13, 2018 (Patch Tuesday) to address this vulnerability. Users should apply the latest Windows 10 cumulative updates and update ChakraCore to a patched version. No workarounds are documented. ChakraCore 1.11 continues to receive security updates until March 9, 2021 [4]; users on later builds should use the latest available fixed version.

References
  1. NVD - CVE-2018-0937
  2. Microsoft ChakraCore Scripting Engine CVE-2018-0937 Remote Memory Corruption Vulnerability
  3. Microsoft Edge Multiple Object Memory Handling Errors Let Remote Users Execute Arbitrary Code and Obtain Potentially Sensitive Information
  4. GitHub - chakra-core/ChakraCore: ChakraCore is an open source Javascript engine with a C API.

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.ChakraCoreNuGet
< 1.8.21.8.2

Affected products

2
  • ghsa-coords
    pkg:nuget/microsoft.chakracore
    Range: < 1.8.2
  • Microsoft Corporation/ChakraCore, Microsoft Edgev5
    Range: ChakraCore, and Microsoft Windows 10 1703 and 1709.

Patches

1
069c3fb1e597

[CVE-2018-0937] Edge - Use after free of LdFld instruction in prePassInstrMap - Google, Inc

https://github.com/chakra-core/ChakraCoremeg-guptaFeb 1, 2018via ghsa
commit
1 file changed · +5 −2
  • lib/Backend/GlobOpt.cpp+5 −2 modified
    @@ -2481,8 +2481,11 @@ GlobOpt::OptInstr(IR::Instr *&instr, bool* isInstrRemoved)
         CurrentBlockData()->KillStateForGeneratorYield();
     }
 
-    // Change LdFld on arrays, strings, and 'arguments' to LdLen when we're accessing the .length field
-    this->TryReplaceLdLen(instr);
+    if (!IsLoopPrePass())
+    {
+        // Change LdFld on arrays, strings, and 'arguments' to LdLen when we're accessing the .length field
+        this->TryReplaceLdLen(instr);
+    }
 
     // Consider: Do we ever get post-op bailout here, and if so is the FillBailOutInfo call in the right place?
     if (instr->HasBailOutInfo() && !this->IsLoopPrePass())

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.