ChakraCore RCE Vulnerability

Also known as GHSA-4f5g-j7wg-7w8j

Published 9 y ago 2016-11-10 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.8

v3.1 · CNA

CISA KEV

Yes

added 2022-03-28

EPSS

80.0%

percentile 100%

Public exploits

Exploit-DB

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.

Known exploited (CISA KEV)

Added: 4 y ago 2022-03-28
Due date: 2022-04-18 (4 y ago)
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Vendor / product: Microsoft / Edge
CISA name: Microsoft Edge Memory Corruption Vulnerability

CISA SSVC assessment

Exploitation: Active — exploited in the wild
Automatable: no
Technical impact: total
Assessed: 20 mo ago 2025-02-10

Exploit prediction (EPSS)

80.00% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

EDB-40990 Microsoft Edge (Windows 10) - 'chakra.dll' Information Leak / Type Confusion Remote Code Execution · remote · 2017-01-05
EDB-40784 Microsoft Edge - 'FillFromPrototypes' Type Confusion · dos · 2016-11-18

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	8.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	3.1	8.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
CNA	3.1	8.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	2.0	7.6	`AV:N/AC:H/Au:N/C:C/I:C/A:C`
GitHub	3.0	7.5	`CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
nuget	`Microsoft.ChakraCore`	<1.2.2	1.2.2

Classification

Weakness

CWE-843 Access of Resource Using Incompatible Type
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

docs.microsoft.com /en-us/security-updates/securitybulletins/2016/ms16-129 · vendor-advisory, x_refsource_MS, x_transferred
packetstormsecurity.com /files/140382/Microsoft-Edge-chakra.dll-Information-Leak-Type-Confusion.html · x_refsource_MISC, x_transferred
github.com /theori-io/chakra-2016-11 · x_refsource_MISC, x_transferred
securityfocus.com /bid/94038 · vdb-entry, x_refsource_BID, x_transferred
exploit-db.com /exploits/40784/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
exploit-db.com /exploits/40990/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
securitytracker.com /id/1037245 · vdb-entry, x_refsource_SECTRACK, x_transferred
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7201 · government-resource
nvd.nist.gov /vuln/detail/CVE-2016-7201 · advisory
github.com /chakra-core/ChakraCore/pull/1982 · web
github.com /chakra-core/ChakraCore/commit/c2787ef8fdb7401922e9ec6540e4e5895d11c631 · web
github.com /chakra-core/ChakraCore · package
web.archive.org /web/20210123185125/http://www.securityfocus.com/bid/94038 · web
web.archive.org /web/20211126224744/http://www.securitytracker.com/id/1037245 · web
exploit-db.com /exploits/40784 · web
exploit-db.com /exploits/40990 · web

Sources

CVE List: CVE-2016-7201
GitHub Advisory: GHSA-4f5g-j7wg-7w8j
NVD: CVE-2016-7201

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary