Read the docs
TI-2019-00436 Aliases CVE-2019-0648GHSA-wwfw-m54g-gv72

An information disclosure vulnerability exists when Chakra improperly discloses the…

Priority LOW 28Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user's computer or data.To exploit the vulnerability, an attacker must know the memory address of where the object was created.The update addresses the vulnerability by changing the way certain functions handle objects in memory, aka Scripting Engine Information Disclosure Vulnerability. This CVE ID is unique from CVE-2019-0658.

Why it matters now

EPSS 0.05432 92nd percentileScored 2026-11-07
Fix Fixed Microsoft.ChakraCore (NuGet): 1.11.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft EdgeWindows 10 Version 1809 for 32-bit Systems; Windows 10 Version 1809 for x64-based Systems; Windows 10 Version 1809 for ARM64-based Systems; Windows Server 2019—No fix listedCNA
—Microsoft.ChakraCore (NuGet)before 1.11.61.11.6Patch availableGHSA-wwfw-m54g-gv72
  • Microsoft Edge VendorMicrosoft Affected Windows 10 Version 1809 for 32-bit Systems; Windows 10 Version 1809 for x64-based Systems; Windows 10 Version 1809 for ARM64-based Systems; Windows Server 2019 Fixed in — No fix listed CNA
  • Microsoft.ChakraCore (NuGet) Vendor— Affected before 1.11.6 Fixed in 1.11.6 Patch available GHSA-wwfw-m54g-gv72

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*1809Running onMicrosoft
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:* Versions 1809 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · GHSA-wwfw-m54g-gv72 Microsoft.ChakraCore (NuGet) Fixed in 1.11.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-0648
  2. 2026-10-03 Alias added: GHSA-wwfw-m54g-gv72

References

Patch 1

Advisory 1

Other 4

  • TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2022-03781 Out-of-bounds write in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2015-00277 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-00275 Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-04799 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
  • TI-2020-12621 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
See all 761 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences