CVE-2018-8229: ChakraCore RCE Vulnerability in Microsoft.ChakraCore
Summary
CVE-2018-8229: ChakraCore RCE Vulnerability. Affects Microsoft.ChakraCore versions < 1.8.5. Fixed in 1.8.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Microsoft.ChakraCore is a NuGet package that provides the Chakra scripting engine, which is used in Microsoft Edge. The Chakra scripting engine is responsible for executing JavaScript code in the browser. It is a critical component for rendering web pages and running web applications. However, a remote code execution vulnerability has been discovered in ChakraCore, which could allow an attacker to execute arbitrary code on a user's system.
Vulnerability Detail
The Chakra scripting engine in Microsoft Edge is vulnerable to a memory corruption issue. This vulnerability occurs due to improper handling of objects in memory. An attacker can exploit this vulnerability by crafting a malicious web page or JavaScript code that triggers the memory corruption. If successful, the attacker can execute arbitrary code with the privileges of the current user. This could lead to various consequences, such as unauthorized access to sensitive information, installation of malware, or complete control over the affected system.
How To Fix
Latest published version: 1.11.24 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.8.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the Microsoft.ChakraCore package to the latest version to address the issue effectively.
Conclusion
The ChakraCore RCE vulnerability in the Microsoft.ChakraCore package poses a significant risk to systems running Microsoft Edge. It is crucial to update the package to the latest version to mitigate the risk of remote code execution. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Microsoft.ChakraCore →
FAQ
This vulnerability allows an attacker to execute arbitrary code on a user's system, potentially leading to unauthorized access, data theft, or system compromise.
This vulnerability affects Microsoft Edge, specifically the Chakra scripting engine used in the browser. The impact may vary depending on the version of Microsoft Edge and the underlying ChakraCore package.
At the time of this advisory, there are no known public exploits targeting this vulnerability. However, it is essential to apply the recommended update to mitigate the risk.
Yes, this vulnerability can be exploited remotely by enticing a user to visit a malicious website or open a specially crafted file containing the exploit code.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for Microsoft.ChakraCore.
