Read the docs
TI-2018-06185 Aliases CVE-2018-8512GHSA-vhfw-vgr5-4gr8

Improper input validation in Microsoft Edge

Priority LOW 31CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

A security feature bypass vulnerability exists in Microsoft Edge when the Edge Content Security Policy (CSP) fails to properly validate certain specially crafted documents, aka "Microsoft Edge Security Feature Bypass Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8530.

Why it matters now

EPSS 0.03451 89th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft EdgeWindows 10 Version 1703 for 32-bit Systems; Windows 10 Version 1703 for x64-based Systems; Windows 10 Version 1709 for 32-bit Systems; Windows 10 Version 1709 for x64-based Systems—No fix listedCNA
  • Microsoft Edge VendorMicrosoft Affected Windows 10 Version 1703 for 32-bit Systems; Windows 10 Version 1703 for x64-based Systems; Windows 10 Version 1709 for 32-bit Systems; Windows 10 Version 1709 for x64-based Systems Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*1703Running onMicrosoft
cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*1709Running onMicrosoft
  • cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:* Versions 1703 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:* Versions 1709 Running on ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-8512
  2. 2026-10-03 Alias added: GHSA-vhfw-vgr5-4gr8

References

Patch 1

  • TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2022-03781 Out-of-bounds write in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2015-00277 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-00275 Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-04799 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
  • TI-2020-12621 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
See all 761 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences