CVE-2019-0539

Vulnerability

A remote code execution vulnerability exists in the Chakra scripting engine (used by Microsoft Edge and ChakraCore) due to improper handling of objects in memory, leading to memory corruption [1]. The vulnerability affects Microsoft Edge on Windows 10 (all versions) and ChakraCore up to version 1.11.4 [2][4]. The issue is triggered when the engine processes specially crafted JavaScript code.

Exploitation

An attacker can exploit this vulnerability by hosting a malicious website and convincing a user to visit it (no authentication required) [2]. The exploit leverages a type confusion bug to gain arbitrary read/write primitives, as demonstrated in a public proof-of-concept [4]. The attacker crafts JavaScript that triggers the memory corruption, then uses the resulting primitive to execute arbitrary code in the context of the current user.

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the current user, potentially leading to full compromise of the browser and, if the user has elevated privileges, the underlying system. This can result in data theft, installation of malware, or further lateral movement within the network.

Mitigation

Microsoft released a security update on January 8, 2019, as part of Patch Tuesday, which addresses this vulnerability in Microsoft Edge [1]. Users should apply the update via Windows Update. For ChakraCore, Microsoft provided security updates for version 1.11 until March 9, 2021; users should upgrade to a patched version (e.g., 1.11.5 or later) [3]. No workarounds are available; applying the update is the only mitigation.