{"id":"CVE-2018-8276","aliases":["EUVD-2022-5570","GHSA-wg47-6cqc-q52j"],"status":"published","title":"ChakraCore Security Bypass","description":"A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard (CFG) to be bypassed, aka \"Scripting Engine Security Feature Bypass Vulnerability.\" This affects Microsoft Edge, ChakraCore.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0577,"percentile":0.93137,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2018-07-11T00:00:00Z","modified":"2026-06-17T02:04:32Z","fixes":[{"ecosystem":"NuGet","package":"Microsoft.ChakraCore","fixed_in":["1.10.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.ChakraCore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.ChakraCore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1"}]}],"versions":["1.10.0","1.2.0","1.2.1","1.2.2","1.2.3","1.2.6.62716-preview","1.3.0","1.3.1","1.3.2","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.5.0","1.5.1","1.5.2","1.5.3","1.6.0","1.6.2","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5"]}],"products":[{"vendor":"microsoft","product":"chakracore"},{"vendor":"microsoft","product":"edge"},{"vendor":"microsoft","product":"microsoft edge"}],"references":[{"url":"http://www.securitytracker.com/id/1041256","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/104626","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8276","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8276","tags":["advisory"]},{"url":"https://github.com/chakra-core/ChakraCore/commit/4196f8097afdcc5fe01ce2966871712fb24003a3","tags":["web"]},{"url":"https://web.archive.org/web/20210124183457/http://www.securityfocus.com/bid/104626","tags":["web"]},{"url":"https://web.archive.org/web/20211202002348/http://www.securitytracker.com/id/1041256","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wg47-6cqc-q52j"},{"url":"https://github.com/chakra-core/ChakraCore","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2018-8276","description":"A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard (CFG) to be bypassed, aka \"Scripting Engine Security Feature Bypass Vulnerability.\" This affects Microsoft Edge, ChakraCore.","status":"published","published":"2018-07-11T00:00:00Z","modified":"2024-08-05T06:46:13.797Z","updated_at":"2026-11-02T14:35:03.825765Z"}],"euvd":[{"id":"EUVD-2022-5570","description":"A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard (CFG) to be bypassed, aka \"Scripting Engine Security Feature Bypass Vulnerability.\" This affects Microsoft Edge, ChakraCore.","status":"published","published":"2018-07-11T00:00:00Z","modified":"2024-08-05T06:46:13Z","updated_at":"2026-11-03T02:40:03.749866Z"}],"ghsa":[{"id":"GHSA-wg47-6cqc-q52j","title":"ChakraCore Security Bypass","description":"A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard (CFG) to be bypassed, aka \"Scripting Engine Security Feature Bypass Vulnerability.\" This affects Microsoft Edge, ChakraCore.","status":"published","published":"2022-05-13T01:53:37Z","modified":"2023-10-06T15:22:26Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T14:37:08.278692Z"}],"nvd":[{"id":"CVE-2018-8276","description":"A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard (CFG) to be bypassed, aka \"Scripting Engine Security Feature Bypass Vulnerability.\" This affects Microsoft Edge, ChakraCore.","status":"published","published":"2018-07-11T00:29:00.897Z","modified":"2026-06-17T02:04:32.613Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:32.929986Z"}],"osv":[{"id":"GHSA-wg47-6cqc-q52j","title":"ChakraCore Security Bypass","description":"A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard (CFG) to be bypassed, aka \"Scripting Engine Security Feature Bypass Vulnerability.\" This affects Microsoft Edge, ChakraCore.","status":"published","published":"2022-05-13T01:53:37Z","modified":"2024-11-30T05:27:45.700124Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:58.767335Z"}]}}