CVE-2018-8466

HIGH

ChakraCore < 1.10.1 and 1.11.1 - Remote Code Execution via Memory Corruption

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-8466. PoCs published by Google Security Research.

AI-analyzed exploit summary This PoC exploits CVE-2018-8466 by bypassing the BailOutOnInvalidatedArrayHeadSegment check in ChakraCore via vtable manipulation, leading to type confusion and potential memory corruption.

Description

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8367, CVE-2018-8465, CVE-2018-8467.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · javascriptdoswindows
https://www.exploit-db.com/exploits/45571

This PoC exploits CVE-2018-8466 by bypassing the BailOutOnInvalidatedArrayHeadSegment check in ChakraCore via vtable manipulation, leading to type confusion and potential memory corruption.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft ChakraCore (Edge/IE)
No auth needed
Prerequisites: Browser with ChakraCore engine (e.g., Microsoft Edge or Internet Explorer)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/45571/
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/105243
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1041623

Scores

CVSS v3 7.5
EPSS 0.8359
EPSS Percentile 99.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (3)
microsoft/chakracore < 1.10.1
microsoft/edge
nuget/Microsoft.ChakraCore 0 - 1.11.1NuGet
Published Sep 13, 2018
Tracked Since Feb 18, 2026