CVE-2016-3382: ChakraCore RCE Vulnerability in Microsoft.ChakraCore
Summary
CVE-2016-3382: ChakraCore RCE Vulnerability. Affects Microsoft.ChakraCore versions < 1.2.1. Fixed in 1.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Microsoft.ChakraCore is an open-source JavaScript engine developed by Microsoft. It is used in various Microsoft products, including Internet Explorer and Microsoft Edge. The engine provides the necessary functionality to interpret and execute JavaScript code in web browsers. However, a vulnerability has been discovered in ChakraCore that allows remote attackers to execute arbitrary code or cause a denial of service through a crafted website.
Vulnerability Detail
The vulnerability, known as CVE-2016-3382 or 'Scripting Engine Memory Corruption Vulnerability,' affects Microsoft Internet Explorer 9 through 11 and Microsoft Edge. It is caused by a memory corruption issue in the scripting engines used by these browsers. By exploiting this vulnerability, an attacker can execute arbitrary code on a victim's system or cause a denial of service by crashing the browser. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 1.11.24 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the Microsoft.ChakraCore package to the latest version.
Conclusion
The ChakraCore RCE vulnerability in Microsoft.ChakraCore poses a significant risk to systems running Microsoft Internet Explorer 9 through 11 and Microsoft Edge. It allows remote attackers to execute arbitrary code or cause a denial of service. To mitigate this vulnerability, it is crucial to update the Microsoft.ChakraCore package to version 1.2.1 or later. For further information and support, please contact DevNack.com.
See every vulnerability recorded for Microsoft.ChakraCore →
FAQ
The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service on systems running Microsoft Internet Explorer 9 through 11 and Microsoft Edge.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, without requiring access to the code or installation.
No, there is no known workaround for this vulnerability. It is crucial to update the Microsoft.ChakraCore package to the latest version.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
For more information and support on vulnerability remediation, you can contact info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for Microsoft.ChakraCore.
