CVE-2019-0611

Vulnerability

CVE-2019-0611 is a remote code execution vulnerability in the Chakra scripting engine used by Microsoft Edge. The bug arises from how the engine handles objects in memory, leading to memory corruption [1].

Exploitation

An attacker could host a specially crafted website designed to trigger the memory corruption when visited with Microsoft Edge. No special privileges are required; the victim simply needs to view the malicious page, which can be done via email or instant messaging lures [2].

Impact

Successful exploitation grants the attacker the same user rights as the current user. If the user has elevated privileges, the attacker could gain full control, including installing programs, viewing or changing data, or creating new accounts [2].

Mitigation

Microsoft released a security update as part of the April 2019 Patch Tuesday, fixing the issue in ChakraCore versions 1.11.7 and later. Users should apply the update to Microsoft Edge and any applications using ChakraCore [2].