CVE-2016-7240

HIGH

Microsoft Edge - Remote Code Execution via Chakra JavaScript Engine Memory Corruption

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-7240. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit leverages a type confusion vulnerability in Chakra (CVE-2016-7240) by calling the global eval function through a Proxy, which adds an extra internal argument. The mismatch in the expected type (FrameDisplay) and the provided type leads to type confusion, potentially allowing arbitrary code execution.

Description

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7201, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7242, and CVE-2016-7243.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · htmldoswindows
https://www.exploit-db.com/exploits/40773

This exploit leverages a type confusion vulnerability in Chakra (CVE-2016-7240) by calling the global eval function through a Proxy, which adds an extra internal argument. The mismatch in the expected type (FrameDisplay) and the provided type leads to type confusion, potentially allowing arbitrary code execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Microsoft Edge (Chakra JavaScript engine)
No auth needed
Prerequisites: Target must be using a vulnerable version of Microsoft Edge with the Chakra engine
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/40773/
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/94046
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1037245

Scores

CVSS v3 7.5
EPSS 0.6929
EPSS Percentile 98.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-119
Status published
Products (2)
microsoft/edge
nuget/Microsoft.ChakraCore 0 - 1.2.2NuGet
Published Nov 10, 2016
Tracked Since Feb 18, 2026