VYPR
← All advisories
High severityNVD Advisory· Published Jul 11, 2018· Updated Aug 5, 2024

CVE-2018-8283

CVE-2018-8283

Description

ChakraCore scripting engine memory corruption vulnerability allows remote code execution when handling objects with setter-only property descriptors.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

ChakraCore scripting engine memory corruption vulnerability allows remote code execution when handling objects with setter-only property descriptors.

Vulnerability

A remote code execution vulnerability exists in the way the ChakraCore scripting engine handles objects in memory, specifically when processing property accessor descriptors. If a property descriptor contains a setter without a corresponding getter (a stale entry), the engine can corrupt memory. All versions of ChakraCore prior to the July 2018 security update are affected [1][4].

Exploitation

An attacker can craft a JavaScript object with a property that has a setter but no getter, causing the engine to incorrectly handle a stale entry in the property map. This can be triggered by hosting a malicious website that loads in a browser using ChakraCore (such as Microsoft Edge). No special privileges are required; user interaction is limited to visiting the malicious page [2][3].

Impact

Successful exploitation results in remote code execution in the context of the current process. An attacker can gain full control over the affected system, including the ability to install programs, view/change/delete data, or create new accounts with full user rights [1][4].

Mitigation

Microsoft released a security update on July 10, 2018, which includes a fix for this vulnerability. Users should update ChakraCore to version 1.10 or later. No workarounds are available. The vulnerability is part of a larger set of fixes addressed in the July 2018 Security Update (Pull Request #5444) [2][3].

References
  1. NVD - CVE-2018-8283
  2. JULY 2018 Security Update by atulkatti · Pull Request #5444 · chakra-core/ChakraCore
  3. [CVE-2018-8283] Edge - ChakraCore Memory Corruption - Individual · chakra-core/ChakraCore@b2f092e
  4. Microsoft ChakraCore Scripting Engine CVE-2018-8283 Remote Memory Corruption Vulnerability

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.ChakraCoreNuGet
< 1.10.11.10.1

Affected products

2

Patches

1
b2f092ea4274

[CVE-2018-8283] Edge - ChakraCore Memory Corruption - Individual

https://github.com/chakra-core/ChakraCoreJimmy ThomsonJun 13, 2018via ghsa
commit
1 file changed · +5 −1
  • lib/Runtime/Types/PathTypeHandler.cpp+5 −1 modified
    @@ -1452,7 +1452,11 @@ namespace Js
                 DictionaryPropertyDescriptor<PropertyIndex> *descriptor;
                 bool result = newTypeHandler->propertyMap->TryGetReference(propertyRecord, &descriptor);
                 Assert(result);
-                Assert(attributes[descriptor->GetDataPropertyIndex<false>()] & ObjectSlotAttr_Accessor);
+                if (!(attributes[descriptor->GetDataPropertyIndex<false>()] & ObjectSlotAttr_Accessor))
+                {
+                    // Setter without a getter; this is a stale entry, so ignore it
+                    continue;
+                }
                 Assert(oldTypeHandler->GetSetterSlotIndex(descriptor->GetDataPropertyIndex<false>()) == newTypeHandler->nextPropertyIndex);
                 descriptor->ConvertToGetterSetter(newTypeHandler->nextPropertyIndex);
                 newTypeHandler->ClearHasOnlyWritableDataProperties();

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.