Read the docs
TI-2018-00872 Aliases CVE-2018-0939GHSA-xgcc-r2f3-rq6p

Out-of-bounds write in Microsoft ChakraCore, Microsoft Edge

Priority LOW 28CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

ChakraCore and Microsoft Edge in Windows 10 1703 and 1709 allow information disclosure, due to how the scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2018-0891.

Why it matters now

EPSS 0.05501 92nd percentileScored 2026-11-07
Fix Fixed Microsoft.ChakraCore (NuGet): 1.8.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftChakraCore, Microsoft EdgeMicrosoft Windows 10 1703 and 1709.—No fix listedCNA
—Microsoft.ChakraCore (NuGet)before 1.8.21.8.2Patch availableGHSA-xgcc-r2f3-rq6p
  • ChakraCore, Microsoft Edge VendorMicrosoft Affected Microsoft Windows 10 1703 and 1709. Fixed in — No fix listed CNA
  • Microsoft.ChakraCore (NuGet) Vendor— Affected before 1.8.2 Fixed in 1.8.2 Patch available GHSA-xgcc-r2f3-rq6p

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*1703Running onMicrosoft
cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*1709Running onMicrosoft
  • cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:* Versions 1703 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:* Versions 1709 Running on ·Microsoft

Remediation

  • Fix · GHSA-xgcc-r2f3-rq6p Microsoft.ChakraCore (NuGet) Fixed in 1.8.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-0939
  2. 2026-10-03 Alias added: GHSA-xgcc-r2f3-rq6p

References

Patch 1

Advisory 1

Other 4

  • TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2022-03781 Out-of-bounds write in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2015-00277 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-00275 Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-04799 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
  • TI-2020-12621 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
See all 761 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences