---
id: "CVE-2018-8298"
kind: "vulnerability"
aliases: ["CVE-2018-8298"]
title: "ChakraCore ChakraCore scripting engine: ChakraCore Scripting Engine Type Confusion Vulnerability"
severity: "critical"
cvss: 7.6
epss: 0.74694
exploited: true
status: "open"
category: "runtime"
products: [{"name": "ChakraCore ChakraCore scripting engine", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "ChakraCore", "fixed": ["1.10.1"], "affected": "< 1.10.1", "ecosystem": "vendor"}, {"name": "Microsoft.ChakraCore", "fixed": ["1.10.1"], "affected": "< 1.10.1", "ecosystem": "nuget"}]
ecosystems: ["nuget", "vendor"]
tags: ["chakracore", "embedded-engine", "exploited", "javascript", "microsoft", "nuget", "runtime"]
not_affected_if: ["not-embedding-chakracore", "unknown", "version-1.10.1-or-later"]
published_at: "2018-07-11T00:29:01+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-8298", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-8298", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:25:56+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8298", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# ChakraCore ChakraCore scripting engine: ChakraCore Scripting Engine Type Confusion Vulnerability

Type confusion/memory corruption in the ChakraCore JavaScript engine (Intl InitializeNumberFormat/InitializeDateTimeFormat bugs) gives remote code execution as the current user when the engine runs attacker-controlled script. Fixed in the July 2018 security update (ChakraCore 1.10.1). In CISA KEV. ChakraCore is no longer maintained by Microsoft, so embedders must be on 1.10.1 or later.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ChakraCore ChakraCore scripting engine affected ? fixed ?
- vendor:ChakraCore affected < 1.10.1 fixed 1.10.1
- nuget:Microsoft.ChakraCore affected < 1.10.1 fixed 1.10.1

## How to check

Find ChakraCore in your app: NuGet Microsoft.ChakraCore package version (dotnet list package | look for < 1.10.1), or the ChakraCore.dll/libChakraCore file version or embedded build. Anything older than 1.10.1 is vulnerable.

## Fix

Upgrade to ChakraCore / Microsoft.ChakraCore 1.10.1 or later (prefer the last 1.11.x, 1.11.24). Do not run untrusted JavaScript in old embedded builds.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-8298
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2018-8298
- 2026-10-23T21:25:56+00:00 analyst — MSRC advisory (Jul 10 2018, Lokihardt/Project Zero) plus GHSA give fix in ChakraCore 1.10.1; MSRC itself said Exploited: No at release, exploitation status comes from CISA KEV. No public PoC found. Fix commit cb9957e in July 2018 PR #5444.
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-8298

## Documents

- [advisory] MSRC CVE-2018-8298 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2018-8298
- [describes] GHSA-wgw2-wwq8-c7wf Microsoft.ChakraCore < 1.10.1 https://github.com/advisories/GHSA-wgw2-wwq8-c7wf
- [fix] ChakraCore July 2018 Security Update PR #5444 https://github.com/chakra-core/ChakraCore/pull/5444

## From the sources

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_