CVE-2018-0939

Vulnerability

An information disclosure vulnerability exists in how the Chakra scripting engine handles objects in memory in Microsoft Edge and ChakraCore. The flaw is present in Windows 10 version 1703 and 1709, as well as in ChakraCore versions used in those builds [1][2]. The vulnerability is triggered by specially crafted web content that causes the scripting engine to mishandle objects in memory, leading to the potential disclosure of sensitive information [3].

Exploitation

An attacker would need to host a specially crafted website (or leverage a compromised site that accepts user-generated content) and convince a user to visit it, typically via a social engineering attack such as a link in an email or instant message. No special authentication or network position is required; the attack is remote and requires user interaction to load the malicious content [2][3].

Impact

Successful exploitation allows an attacker to obtain potentially sensitive information from the target system's memory. The vulnerability does not directly allow code execution, but enables information disclosure that could be chained with other vulnerabilities for further compromise [3]. The victim's system does not need to be running in an elevated privilege context; the disclosure occurs at the user's privilege level.

Mitigation

Microsoft released security updates on March 13, 2018, as part of the Monthly Rollup, to address this vulnerability in Windows 10 1703 and 1709, and in the ChakraCore component [2][3]. Users should apply the March 2018 security patches. No workarounds are documented. ChakraCore version 1.11 received security updates until March 9, 2021, after which support ended [4]. This CVE is not listed in the CISA Known Exploited Vulnerabilities Catalog.