CVE-2018-8355

What it actually does

Memory corruption in the scripting engine allows an attacker to execute arbitrary code in the context of the current user when a crafted webpage is rendered in affected Microsoft browsers or ChakraCore.

Why it matters to the business

Attackers can take full control of affected Windows systems, leading to data theft, ransomware deployment, or use as an entry point for broader network compromise; the high EPSS score and public exploit availability increase urgency for legacy environments still running unpatched browsers.

How an attack unfolds

An attacker crafts a malicious webpage that triggers the memory corruption flaw in the scripting engine when rendered by Internet Explorer, Edge, or ChakraCore; successful exploitation grants code execution, which can be chained with other techniques for persistence or lateral movement.

How to fix it

Apply the latest cumulative security updates for Internet Explorer, Microsoft Edge, and Windows components; disable scripting where possible and migrate away from legacy browsers; monitor for any remaining ChakraCore instances and update them to patched builds.

How to confirm the fix worked

Verify that affected systems are running current Windows and browser patches; use vendor security update catalogs or configuration management tools to confirm absence of the vulnerable scripting engine versions; re-scan with vulnerability assessment tools post-patching.

Typical attack path

1. Attacker hosts or compromises a website serving a specially crafted HTML/JavaScript payload
2. Victim is tricked into visiting the page via phishing or drive-by download
3. Browser scripting engine processes the object in memory and triggers the corruption
4. Attacker gains arbitrary code execution in the browser process
5. Payload escalates privileges or installs further malware on the Windows system

How to detect it

Search web proxy and browser history logs for access to suspicious domains around the time of suspected incidents; examine endpoint process creation logs for unexpected scripting or browser child processes; review Windows event logs for anomalous crashes in iexplore.exe or MicrosoftEdge.exe.

What your security team should do

• Prioritize patching of any remaining Internet Explorer or legacy Edge installations due to public exploit availability
• Block or restrict access to untrusted websites for users on older Windows versions
• Review browser usage policies and accelerate migration to modern, supported browsers
• Include memory corruption indicators in endpoint detection rules for scripting engine processes