VYPR
← All advisories
High severityNVD Advisory· Published Jul 11, 2018· Updated Aug 5, 2024

CVE-2018-8288

CVE-2018-8288

Description

A memory corruption vulnerability in the Chakra scripting engine allows remote code execution via specially crafted ActiveX controls in Microsoft Edge, Internet Explorer 11, and ChakraCore.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A memory corruption vulnerability in the Chakra scripting engine allows remote code execution via specially crafted ActiveX controls in Microsoft Edge, Internet Explorer 11, and ChakraCore.

Vulnerability

The scripting engine (Chakra) in Microsoft Edge, Internet Explorer 11, and ChakraCore prior to the July 2018 security updates contains a remote code execution vulnerability due to improper handling of objects in memory. This memory corruption can be triggered when a user loads specially crafted content, including ActiveX controls marked as safe for initialization, in an application that hosts the rendering engine (e.g., Microsoft Office documents or the WebBrowser control). Affected versions include all builds before the patches released on July 10, 2018. [1][2][3]

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a malicious file or visit a website hosting the crafted ActiveX control. No authentication is required, but user interaction is necessary. The attacker must create a malicious ActiveX control or crafted content that, when processed by the scripting engine, causes memory corruption. This can be delivered via a web page, email attachment, or any medium that triggers the rendering engine. [3]

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the current user. If the user has administrative privileges, the attacker can gain full control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights. The impact is consistent with a remote code execution vulnerability. [2][3]

Mitigation

Microsoft released security updates on July 10, 2018, as part of the monthly Patch Tuesday, which address this vulnerability. Users should apply the latest cumulative updates for Internet Explorer 11 and Microsoft Edge (e.g., KB 4338829 for Edge, KB 4339093 for IE). For ChakraCore, Microsoft provided security updates until March 9, 2021, and recommends updating to the latest supported version. No workarounds are documented; applying the patch is the only mitigation. [1][3][4]

References
  1. Microsoft Internet Explorer and Edge CVE-2018-8288 Remote Memory Corruption Vulnerability
  2. NVD - CVE-2018-8288
  3. Microsoft Edge Multiple Object Memory Handling Errors Let Remote Users Execute Arbitrary Code and Bypass Security Restrictions
  4. GitHub - chakra-core/ChakraCore: ChakraCore is an open source Javascript engine with a C API.

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.ChakraCoreNuGet
< 1.10.11.10.1

Affected products

4

Patches

1
f9b1cded6631

[CVE-2018-8288] Edge - Chakra JIT ImplicitCallFlags check bypass with Intl - Google, Inc.

https://github.com/chakra-core/ChakraCoreRajat DuaJun 19, 2018via ghsa
commit
1 file changed · +3 −10
  • lib/Runtime/Library/IntlEngineInterfaceExtensionObject.cpp+3 −10 modified
    @@ -742,18 +742,11 @@ namespace Js
             Js::Var args[] = { scriptContext->GetLibrary()->GetUndefined(), scriptContext->GetLibrary()->GetEngineInterfaceObject(), initType };
             Js::CallInfo callInfo(Js::CallFlags_Value, _countof(args));
 
-            // Clear disable implicit call bit as initialization code doesn't have any side effect
-            Js::ImplicitCallFlags saveImplicitCallFlags = scriptContext->GetThreadContext()->GetImplicitCallFlags();
-            scriptContext->GetThreadContext()->ClearDisableImplicitFlags();
-
             Js::Arguments arguments(callInfo, args);
-            BEGIN_SAFE_REENTRANT_CALL(scriptContext->GetThreadContext())
+            scriptContext->GetThreadContext()->ExecuteImplicitCall(function, Js::ImplicitCall_Accessor, [=]()->Js::Var 
             {
-                JavascriptFunction::CallRootFunctionInScript(function, arguments);
-            }
-            END_SAFE_REENTRANT_CALL
-
-            scriptContext->GetThreadContext()->SetImplicitCallFlags((Js::ImplicitCallFlags)(saveImplicitCallFlags));
+                return JavascriptFunction::CallRootFunctionInScript(function, arguments);
+            });
 
             // Delete prototypes on functions if initialized Intl object
             if (intlInitializationType == IntlInitializationType::Intl)

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.