VYPR
← All advisories
High severityNVD Advisory· Published Jul 11, 2018· Updated Aug 5, 2024

CVE-2018-8294

CVE-2018-8294

Description

A memory corruption vulnerability in ChakraCore and Microsoft Edge allows remote code execution via crafted web content.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A memory corruption vulnerability in ChakraCore and Microsoft Edge allows remote code execution via crafted web content.

Vulnerability

A remote code execution vulnerability exists in the way the Chakra scripting engine handles objects in memory. The bug affects both Microsoft Edge and the open-source ChakraCore JavaScript engine. It is classified as a memory corruption vulnerability. This CVE affects all versions of Microsoft Edge bundled with Windows 10 and ChakraCore prior to the July 2018 security update. [1][2]

Exploitation

An attacker can host a specially crafted website (or inject content into a compromised site) that, when visited by the victim through Microsoft Edge or an application embedding ChakraCore, triggers the memory corruption via the scripting engine. No additional user interaction beyond browsing the page is required. The attack is remote and exploits the object handling flaw in Chakra. [1][3]

Impact

Successful exploitation gives the attacker the ability to execute arbitrary code in the context of the current user. If the user has administrative rights, the attacker could install programs, view/change/delete data, or create new accounts with full user rights. The compromise occurs at the privilege level of the browsing user. [1][3]

Mitigation

Microsoft released a security update on July 10, 2018, to fix this vulnerability (part of the July 2018 Patch Tuesday). Users should apply the update via Windows Update or the Microsoft Update Catalog. For ChakraCore, Microsoft recommends updating to a patched version (1.11.x with the July 2018 security fix). No workaround is available. ChakraCore support ended March 2021. [1][3][4]

References
  1. NVD - CVE-2018-8294
  2. Microsoft Edge Scripting Engine CVE-2018-8294 Remote Memory Corruption Vulnerability
  3. Microsoft Edge Multiple Object Memory Handling Errors Let Remote Users Execute Arbitrary Code and Bypass Security Restrictions
  4. GitHub - chakra-core/ChakraCore: ChakraCore is an open source Javascript engine with a C API.

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.ChakraCoreNuGet
< 1.10.11.10.1

Affected products

3

Patches

1
7af07fdfb3cf

[CVE-2018-8294] Edge - In Cross Context scenario check for new target first before marshalling the last parameter to a FrameDisplay - Internal

https://github.com/chakra-core/ChakraCoreAtul KattiJul 3, 2018via ghsa
commit
2 files changed · +7 −2
  • lib/Runtime/Base/CrossSite.cpp+6 −1 modified
    @@ -489,7 +489,12 @@ namespace Js
         {
             args.Values[i] = CrossSite::MarshalVar(targetScriptContext, args.Values[i]);
         }
-        if (args.HasExtraArg())
+        if (args.HasNewTarget())
+        {
+            // Last value is new.target
+            args.Values[count] = CrossSite::MarshalVar(targetScriptContext, args.GetNewTarget());
+        }
+        else if (args.HasExtraArg())
         {
             // The final eval arg is a frame display that needs to be marshaled specially.
             args.Values[count] = CrossSite::MarshalFrameDisplay(targetScriptContext, args.GetFrameDisplay());
  • lib/Runtime/Language/Arguments.h+1 −1 modified
    @@ -229,7 +229,7 @@ namespace Js
 
         FrameDisplay* GetFrameDisplay() const
         {
-            AssertOrFailFast(Info.Flags & CallFlags_ExtraArg);
+            AssertOrFailFast((Info.Flags & CallFlags_ExtraArg) && (!this->HasNewTarget()));
 
             // There is an extra arg, so values should have Count + 1 members
             return (FrameDisplay*)(this->Values[Info.Count]);

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.