CVE-2016-7286

HIGH

Microsoft Edge - Remote Code Execution via Scripting Engine Memory Corruption

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-7286. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit leverages a type confusion vulnerability in ChakraCore's SIMD object handling, where passing more than three arguments to `toLocaleString` causes uninitialized memory access, potentially leading to arbitrary code execution.

Description

The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7288, CVE-2016-7296, and CVE-2016-7297.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · htmldoswindows

https://www.exploit-db.com/exploits/40947

View Code ZIP pw:eip

This exploit leverages a type confusion vulnerability in ChakraCore's SIMD object handling, where passing more than three arguments to `toLocaleString` causes uninitialized memory access, potentially leading to arbitrary code execution.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Microsoft Edge (ChakraCore) before CVE-2016-7286 patch

No auth needed

Prerequisites: Browser with vulnerable ChakraCore engine

MITRE ATT&CK