CVE-2016-7200highunder attackCWE-787

CVE-2016-7200

Published · Updated

Follow this CVE+ Monitor Microsoft Edge+ Monitor Microsoft.ChakraCore

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

98Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.8epss 83%
from disclosure to weapon8 days
Published on NVDNov 10
1st PoC+8d
CISA KEV+1964d
Action required by CISAfederal deadline: 2022-04-18

Apply updates per vendor instructions.

In short

A flaw in Microsoft Edge's JavaScript engine allows attackers to run malicious code or crash your browser by visiting a specially crafted website. This happens because the engine doesn't properly manage memory, leaving it vulnerable to abuse.

Technical detail

Out-of-bounds write vulnerability (CWE-787) in the Chakra JavaScript engine allows remote code execution or denial of service through crafted JavaScript. Attack vector is network-based via malicious web content; no user interaction beyond visiting a compromised site is required. Impact includes arbitrary code execution with browser privileges and memory corruption.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7201, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.