CVE-2018-8452
ChakraCore information disclosure vulnerability
An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft browsers, aka "Scripting Engine Information Disclosure Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft browsers, aka "Scripting Engine Information Disclosure Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge.
- Record
CVE-2018-8452- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft browsers, aka "Scripting Engine Information Disclosure Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge.
- Record
CVE-2018-8452- Updated
- 2026-11-02
EUVDEUVD-2022-5483 No score
An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft browsers, aka "Scripting Engine Information Disclosure Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge.
- Record
EUVD-2022-5483- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w3qr-8v4r-592m
ChakraCore information disclosure vulnerability
An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft browsers, aka "Scripting Engine Information Disclosure Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge.
- Record
GHSA-w3qr-8v4r-592m- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-w3qr-8v4r-592m
ChakraCore information disclosure vulnerability
An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft browsers, aka "Scripting Engine Information Disclosure Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge.
- Record
GHSA-w3qr-8v4r-592m- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Microsoft.ChakraCoreNuGet |
before 1.11.1 | 1.11.1 |
Microsoft.ChakraCoreNuGet |
before 1.11.1, plus listed versions 1.10.01.10.11.10.21.11.01.2.0 Show 32 moreShow less1.2.11.2.21.2.31.2.6.62716-preview1.3.01.3.11.3.21.4.01.4.11.4.21.4.31.4.41.4.51.5.01.5.11.5.21.5.31.6.01.6.21.7.01.7.11.7.21.7.31.7.41.7.51.7.61.8.01.8.11.8.21.8.31.8.41.8.5 |
1.11.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-8452 is a medium vulnerability (CVSS 4.3) in Microsoft Chakracore, published September 13, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.59%, the 92nd percentile. Fixed in Microsoft.ChakraCore 1.11.1.
References
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8452
securityfocus.com/bid/105252
securitytracker.com/id/1041623
nvd.nist.gov/vuln/detail/CVE-2018-8452
github.com/chakra-core/ChakraCore/commit/3f3544801cc01e9f54cab84b20602a3b5e29c3ef
web.archive.org/web/20210124203129/http://www.securityfocus.com/bid/105252