CVE-2018-8298 KEVPublic exploit High · 7.5 EPSS 74.7%

ChakraCore Scripting Engine Type Confusion Vulnerability

ChakraCore · ChakraCore scripting engine

Summary

The ChakraCore scripting engine, which is the component of the ChakraCore product that handles objects in memory, contains a type confusion flaw that results in memory corruption. An attacker who can get a victim to interact with malicious content (user interaction required, with no authentication needed and network-based access) can achieve remote code execution, though exploitation depends on a high-complexity attack condition.

Official description · NVD

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.

Breakdown

68.2 / 100

Exploited: Yes, in CISA KEV
Reports: 0
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Infect visitors through a malicious websiteT1189 · Drive-by CompromiseAI-written (claude-haiku-5-5)Medium confidence3 general detection rules
What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterAI-written (claude-haiku-5-5)Medium confidence95 general detection rules

First seen exploited 4 years after disclosure. Public exploit code (Exploit-DB) appeared 37 days after disclosure.

Disclosed11 Jul 2018day 0
Public exploit codeExploit-DB17 Aug 2018+37 days
First seen exploitedVulnCheck KEV evidenceAdded to CISA KEVEU database agrees3 Mar 2022+4 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Drive-by Compromise T1189 Medium

AI mapping from the description · how it is exploited

Scripting engine memory corruption via browser content

remote code execution vulnerability exists in the way that the ChakraCore scripting engine

From the official description (NVD) Original ↗

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

AI mapping from the description · primary impact

Arbitrary code execution through scripting engine

remote code execution vulnerability exists in the way that the ChakraCore scripting engine

From the official description (NVD) Original ↗

Detection

0 rules for this CVE · 98 general rules for its techniques

Rules for this CVE

0 that reference CVE-2018-8298 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Drive-by CompromiseT11893 general rules

Cross Site Scripting Stringshightest
Flash Player Update from Suspicious Locationhightest
Suspicious Browser Child Process - MacOSmediumtest

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: Microsoft.ChakraCore.

NuGetMicrosoft.ChakraCoreGHSA-wgw2-wwq8-c7wf

Upgrade to 1.11.11 or later

Fixes this CVE and 44 other known vulnerabilities in this package (CVE-2016-0191, CVE-2016-0193, +42).

Set the version to 1.11.11 or later in your .csproj.

First fixed in 1.10.1 for CVE-2018-8298.

Affected versions

If you run	Upgrade to
All versions before 1.10.1	1.11.11first fix for this CVE: 1.10.1

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

4 links, grouped by NVD tag (3 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 3 Mar 2022. Federal due date 17 Mar 2022. No recorded ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 3 Mar 2022. EUVD-2022-5575

Microsoft Edge Chakra JIT - InitializeNumberFormat and InitializeDateTimeFormat Type ConfusionEDB-45217 · dos · windows · 2018-08-17 · verified

, 30 Oct 2026

74.7%Top 0.5%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.5%).

3.1

7.5High · 7.5

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 1703 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9950 19.9/20

Threat reports0 reports 0.0/10

Public exploit code1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 advisory exploit reference 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 7.5 5.3/7

End-of-life productsupported or unknown 0.0

Total68.2

Record

Published: 11 Jul 2018
Modified: 17 Jun 2026
: CWE-843 Access of Resource Using Incompatible Type
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ExecutionTA0002

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

US Government Resource 1

Third Party Advisory 2

How attackers get in

What they do

techniques