CVE-2018-8542
Description
A remote code execution vulnerability exists in Chakra scripting engine due to a type confusion bug in the ValueType::MergeWithObject function, affecting Microsoft Edge and ChakraCore.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A remote code execution vulnerability exists in Chakra scripting engine due to a type confusion bug in the ValueType::MergeWithObject function, affecting Microsoft Edge and ChakraCore.
Vulnerability
A remote code execution vulnerability exists in the Chakra scripting engine used by Microsoft Edge and ChakraCore [1]. The issue stems from a type confusion in the ValueType::MergeWithObject function, where improper handling of array object types can lead to memory corruption [3]. This affects all versions of Microsoft Edge and ChakraCore prior to the fix committed on GitHub [3][4].
Exploitation
An attacker would need to host a specially crafted web page that, when visited using a vulnerable version of Microsoft Edge, triggers the type confusion condition [2]. The exploitation does not require authentication or any special privileges; it only requires user interaction (visiting a malicious site) [2]. The specific code path involves merging object types that include array types, leading to an inconsistent type state [3].
Impact
Successful exploitation allows an attacker to achieve remote code execution in the context of the current user [1]. This means the attacker could gain the same privileges as the logged-on user, potentially leading to installation of programs, viewing, changing, or deleting data, or creating new accounts with full user rights [1]. If the user is an administrator, the attacker could take complete control of the affected system [1].
Mitigation
The vulnerability was fixed by Microsoft in a security update released on November 13, 2018 [1]. For ChakraCore, the fix was included in commit 334471b [3]. Users should apply the latest security updates for Microsoft Edge or update to the latest version of ChakraCore [4]. ChakraCore 1.11 continued to receive security updates until March 9, 2021 [4]. No workarounds are listed in the references.
AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
Microsoft.ChakraCoreNuGet | < 1.11.3 | 1.11.3 |
Affected products
3- Range: ChakraCore
Patches
11 file changed · +26 −12
lib/Runtime/Language/ValueType.cpp+26 −12 modified@@ -1055,6 +1055,10 @@ ValueType ValueType::MergeWithObject(const ValueType other) const { // Any two different specific object types (excludes UninitializedObject and Object, which don't indicate any // specific type of object) merge to Object since the resulting type is not guaranteed to indicate any specific type + if (IsArrayOrObjectWithArray() || other.IsArrayOrObjectWithArray()) + { + return Verify(GetObject(ObjectType::Object).ToLikely()); + } merged.SetObjectType(ObjectType::Object); return Verify(merged); } @@ -1945,13 +1949,18 @@ void ValueType::RunUnitTests() )); if(!( - t0.IsObject() && t1.IsObject() && // both are objects + t0.IsObject() && t1.IsObject() && // both are objects ( - t0.GetObjectType() == ObjectType::UninitializedObject || - t1.GetObjectType() == ObjectType::UninitializedObject - ) && // one has an uninitialized object type - (t0.GetObjectType() > ObjectType::Object || t1.GetObjectType() > ObjectType::Object) // one has a specific object type - )) // then the resulting object type is not guaranteed + ( + ( + t0.GetObjectType() == ObjectType::UninitializedObject || + t1.GetObjectType() == ObjectType::UninitializedObject + ) && // one has an uninitialized object type + (t0.GetObjectType() > ObjectType::Object || t1.GetObjectType() > ObjectType::Object) // one has a specific object type + ) || + (t0.IsArrayOrObjectWithArray() || t1.IsArrayOrObjectWithArray()) // or one was an array or an object with array + ) + )) // then the resulting object type is not guaranteed { Assert(m.IsNotInt() == (t0.IsNotInt() && t1.IsNotInt())); } @@ -1990,13 +1999,18 @@ void ValueType::RunUnitTests() Assert(m.IsLikelyString() == (t0.IsLikelyString() && t1.IsLikelyString())); if(!( - t0.IsObject() && t1.IsObject() && // both are objects + t0.IsObject() && t1.IsObject() && // both are objects ( - t0.GetObjectType() == ObjectType::UninitializedObject || - t1.GetObjectType() == ObjectType::UninitializedObject - ) && // one has an uninitialized object type - (t0.GetObjectType() > ObjectType::Object || t1.GetObjectType() > ObjectType::Object) // one has a specific object type - )) // then the resulting object type is not guaranteed + ( + ( + t0.GetObjectType() == ObjectType::UninitializedObject || + t1.GetObjectType() == ObjectType::UninitializedObject + ) && // one has an uninitialized object type + (t0.GetObjectType() > ObjectType::Object || t1.GetObjectType() > ObjectType::Object) // one has a specific object type + ) || + (t0.IsArrayOrObjectWithArray() || t1.IsArrayOrObjectWithArray()) // or one was an array or an object with array + ) + )) // then the resulting object type is not guaranteed { Assert(m.IsObject() == (t0.IsObject() && t1.IsObject())); }
Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
9- github.com/advisories/GHSA-hfhr-xxxq-vg7gghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2018-8542ghsaADVISORY
- www.securityfocus.com/bid/105772mitrevdb-entryx_refsource_BID
- www.securitytracker.com/id/1042107mitrevdb-entryx_refsource_SECTRACK
- github.com/chakra-core/ChakraCore/commit/334471b7254c1c093deb413bac0472974e6f9181ghsaWEB
- github.com/chakra-core/ChakraCore/pull/5827ghsaWEB
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8542ghsax_refsource_CONFIRMWEB
- web.archive.org/web/20210124213906/http://www.securityfocus.com/bid/105772ghsaWEB
- web.archive.org/web/20211126224439/http://www.securitytracker.com/id/1042107ghsaWEB
News mentions
0No linked articles in our index yet.