CVE-2016-7201highunder attackCWE-843

CVE-2016-7201

Published · Updated

Follow this CVE+ Monitor Microsoft Edge+ Monitor Microsoft.ChakraCore

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

93Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.8epss 80%
from disclosure to weapon8 days
Published on NVDNov 10
1st PoC+8d
CISA KEV+1964d
Action required by CISAfederal deadline: 2022-04-18

Apply updates per vendor instructions.

In short

A flaw in Microsoft Edge's JavaScript engine allows attackers to run malicious code or crash the browser by visiting a crafted website. This happens because the engine doesn't properly manage memory, leaving it vulnerable to exploitation.

Technical detail

Type confusion vulnerability in Chakra JavaScript engine enables remote code execution or denial of service through crafted web content. Attack requires user to visit a malicious site; no authentication or user interaction beyond browsing is needed. Memory corruption leads to arbitrary code execution with Edge process privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.