CVE-2018-8298

CVE-2018-8298 is a type-confusion (CWE-843) remote code execution flaw in Microsoft's ChakraCore JavaScript engine, which mishandles objects in memory. An attacker triggers it by getting a user or an embedding application to execute attacker-crafted JavaScript, causing the engine to misinterpret object types and corrupt memory (CVSS shows a network attack vector with high complexity and required user interaction). Successful exploitation yields code execution in the context of the hosting process, with high confidentiality, integrity, and availability impact. Anyone running ChakraCore is affected — most prominently the legacy Microsoft Edge browser shipped with Windows 10, plus standalone or embedded ChakraCore builds such as Node.js-ChakraCore; Microsoft is the assigning vendor. Exploitation is confirmed: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03), carries an EPSS of 74.8% (99th percentile), and a public proof-of-concept is referenced (Exploit-DB 45217).

What to do: Apply Microsoft's Patch Tuesday security updates and update ChakraCore to the vendor's current patched release per the CISA KEV required action (see Microsoft's advisory for the exact fixed version). Audit for anything still embedding ChakraCore — legacy Edge on Windows 10, node-chakracore builds, and IoT/embedded integrations — and update or retire it, since modern Chromium-based Edge no longer uses ChakraCore. Until patched, limit rendering of untrusted JavaScript in ChakraCore-hosted applications.