CVE-2018-8452: ChakraCore information disclosure vulnerability in Microsoft.ChakraCore
Summary
CVE-2018-8452: ChakraCore information disclosure vulnerability. Affects Microsoft.ChakraCore versions < 1.11.1. Fixed in 1.11.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Microsoft.ChakraCore is an open-source JavaScript engine developed by Microsoft. It is used in Microsoft browsers, including Internet Explorer 11 and Microsoft Edge. ChakraCore provides the runtime environment for executing JavaScript code in these browsers. However, a vulnerability has been identified in ChakraCore that can lead to information disclosure.
Vulnerability Detail
The vulnerability, known as "Scripting Engine Information Disclosure Vulnerability", arises from the improper handling of objects in memory by the scripting engine in Microsoft browsers. This vulnerability affects ChakraCore, Internet Explorer 11, and Microsoft Edge. An attacker could exploit this vulnerability to gain unauthorized access to sensitive information. The severity of this vulnerability is rated as MODERATE with a CVSS score of 4.3.
How To Fix
Latest published version: 1.11.24 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Microsoft.ChakraCore package to the latest version to mitigate the risk of information disclosure.
Conclusion
In conclusion, the ChakraCore information disclosure vulnerability in Microsoft.ChakraCore, Internet Explorer 11, and Microsoft Edge can lead to unauthorized access to sensitive information. To mitigate this risk, it is crucial to update the Microsoft.ChakraCore package to version 1.11.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Microsoft.ChakraCore →
FAQ
Microsoft.ChakraCore is an open-source JavaScript engine developed by Microsoft. It is used in Microsoft browsers to execute JavaScript code.
This vulnerability affects Internet Explorer 11 and Microsoft Edge, as they both use ChakraCore as their JavaScript engine.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 4.3.
To fix this vulnerability, update the Microsoft.ChakraCore package to version 1.11.1 or later.
No, there is no known workaround for this vulnerability. Updating the Microsoft.ChakraCore package is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for Microsoft.ChakraCore.
