CVE-2020-0811
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based)L, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0812.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based)L, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0812.
- Record
CVE-2020-0811- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.6 High
AV:N/AC:H/Au:N/C:C/I:C/A:C - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based)L, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0812.
- Record
CVE-2020-0811- Updated
- 2026-11-02
EUVDEUVD-2022-4757 No score
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based)L, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0812.
- Record
EUVD-2022-4757- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pg99-mp4c-75g6
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based)L, aka Chakra Scripting Engine Memory Corruption Vulnerability. This CVE ID is unique from CVE-2020-0812.
- Record
GHSA-pg99-mp4c-75g6- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSVGHSA-pg99-mp4c-75g6
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based)L, aka Chakra Scripting Engine Memory Corruption Vulnerability. This CVE ID is unique from CVE-2020-0812.
- Record
GHSA-pg99-mp4c-75g6- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
Affected products
- microsoft chakracore
- microsoft edge
- microsoft edge (edgehtml-based) on windows 10 version 1709 for 32-bit systems
- microsoft edge (edgehtml-based) on windows 10 version 1709 for arm64-based systems
- microsoft edge (edgehtml-based) on windows 10 version 1709 for x64-based systems
- microsoft edge (edgehtml-based) on windows 10 version 1803 for 32-bit systems
- microsoft edge (edgehtml-based) on windows 10 version 1803 for arm64-based systems
- microsoft edge (edgehtml-based) on windows 10 version 1803 for x64-based systems
- microsoft edge (edgehtml-based) on windows 10 version 1809 for 32-bit systems
- microsoft edge (edgehtml-based) on windows 10 version 1809 for arm64-based systems
- microsoft edge (edgehtml-based) on windows 10 version 1809 for x64-based systems
- microsoft edge (edgehtml-based) on windows 10 version 1903 for 32-bit systems
Show 6 moreShow less
- microsoft edge (edgehtml-based) on windows 10 version 1903 for arm64-based systems
- microsoft edge (edgehtml-based) on windows 10 version 1903 for x64-based systems
- microsoft edge (edgehtml-based) on windows 10 version 1909 for 32-bit systems
- microsoft edge (edgehtml-based) on windows 10 version 1909 for arm64-based systems
- microsoft edge (edgehtml-based) on windows 10 version 1909 for x64-based systems
- microsoft edge (edgehtml-based) on windows server 2019
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Microsoft.ChakraCoreNuGet |
before 1.11.17 | 1.11.17 |
Microsoft.ChakraCoreNuGet |
before 1.11.17, plus listed versions 1.10.01.10.11.10.21.11.01.11.1 Show 45 moreShow less1.11.101.11.111.11.121.11.131.11.141.11.151.11.161.11.21.11.31.11.41.11.51.11.61.11.71.11.81.11.91.2.01.2.11.2.21.2.31.2.6.62716-preview1.3.01.3.11.3.21.4.01.4.11.4.21.4.31.4.41.4.51.5.01.5.11.5.21.5.31.6.01.6.21.7.01.7.11.7.21.7.31.7.41.7.51.7.61.8.01.8.11.8.2 |
1.11.17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-0811 is a high vulnerability (CVSS 7.5) in Microsoft Chakracore, published March 12, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.71%, the 94th percentile. Fixed in Microsoft.ChakraCore 1.11.17.
References
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0811
nvd.nist.gov/vuln/detail/CVE-2020-0811
github.com/chakra-core/ChakraCore/pull/6385
Left out here: 3 versions. The JSON record has them.