CVE-2016-7200KEV · OVERDUE

Microsoft Edge Memory Corruption Vulnerability

High · published November 10, 2016

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 99.7th percentile for exploit probability.

1649
days past CISA
deadline
CVSS v3.1
8.8
EPSS
83%
Percentile
99.7
In the wild
Confirmed
What it is

🚨 A crafty web page can exploit this vulnerability, allowing attackers to execute whatever code they want on your system! ⚡ Think of it like a restaurant where a delivery driver brings in a package that looks delicious but is actually filled with poison — if the kitchen doesn't inspect it properly, anyone eating there is in danger! Hackers could hijack your computer, executing malicious scripts that could steal your data, corrupt your files, or even crash your system entirely. The potential for chaos is absolutely devastating!

Put simply

Think of it like a restaurant where a delivery driver brings in a package that looks delicious but is actually filled with poison — if the kitchen doesn't inspect it properly, anyone eating there is in danger! This vulnerability in the Chakra JavaScript engine of Microsoft Edge allows attackers to execute arbitrary code through crafted websites, leading to memory corruption and denial of service.

What to do

Hackers could hijack your computer, executing malicious scripts that could steal your data, corrupt your files, or even crash your system entirely. The potential for chaos is absolutely devastating! Update Microsoft Edge to the latest version immediately to patch this vulnerability. Ensure that your security settings are configured to block untrusted websites and consider using a reputable antivirus to add another layer of protection. You've got this! By updating and staying aware, you're taking important steps to keep your system secure. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.82779 · 99.7th percentile
Published
2016-11-10T06:16Z
KEV added
2022-03-28 · due 2022-04-18
EPSS history
Timeline
  • 28 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 18
    kev
  • 10 NOV 06:16Z
    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via…
    cvelistv5