CVE-2016-7200
Microsoft Edge Memory Corruption Vulnerability
Description
CVE-2016-7200 is a critical memory corruption vulnerability (CWE-119) in the Chakra JavaScript engine used by Microsoft Edge that enables remote code execution when a user visits a specially crafted web page. The vulnerability stems from improper handling of objects in memory during JavaScript execution, allowing an attacker to corrupt memory and execute arbitrary code with the privileges of the current user. CISA has confirmed active exploitation and added CVE-2016-7200 to the Known Exploited Vulnerabilities catalog. With an EPSS score of 89.2% (98.8th percentile), this vulnerability presents a severe risk to organizations running affected versions of Microsoft Edge.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | edge | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/140382/Microsoft-Edge-chakra.dll-Information-Leak-Type-Confusion.html(Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/93968(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1037245(Broken Link, Third Party Advisory, VDB Entry)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-129(Patch, Vendor Advisory)
- https://github.com/theori-io/chakra-2016-11(Exploit, Third Party Advisory)
- https://www.exploit-db.com/exploits/40785/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/40990/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7200(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-119 describes a weakness where software performs operations on a memory buffer without properly restricting read or write operations to the intended boundaries of that buffer, leading to memory corruption, data disclosure, or arbitrary code execution. In CVE-2016-7200, the Chakra JavaScript engine fails to properly validate memory boundaries when processing JavaScript objects, enabling an attacker to corrupt adjacent memory and redirect program execution.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2016-7200 is exploitable remotely through a malicious web page with no authentication required from the attacker and minimal user interaction — the victim only needs to visit or be redirected to the attacker-controlled page. Successful exploitation yields code execution with the privileges of the current user, which can include full administrative control on systems where users operate with elevated privileges. Confidentiality is fully compromised as attackers can access all data available to the browser process and user session. Integrity and availability are equally impacted, as attackers can install persistent malware, modify system files, and disable security controls. The 98.8th percentile EPSS score reflects the high weaponization level and active use of this exploit in real-world attack campaigns.
Exploit Maturity
CVE-2016-7200 is confirmed as actively exploited by CISA and is listed in the Known Exploited Vulnerabilities catalog. The EPSS score of 89.2% (98.8th percentile) indicates an extremely high probability of exploitation, consistent with the existence of public exploit code and active campaigns targeting Chakra engine memory corruption flaws. Browser-based exploitation is particularly effective due to the low barrier to entry — attackers can deliver the exploit through drive-by download attacks, malvertising campaigns, or compromised websites.
Remediation
- Apply the Microsoft security update MS16-129 (November 2016) for Microsoft Edge to address CVE-2016-7200 immediately.
- If immediate patching is not feasible, restrict JavaScript execution in Microsoft Edge or limit browsing to trusted websites as a temporary workaround.
- Migrate from legacy Microsoft Edge (EdgeHTML) to Microsoft Edge (Chromium) or another actively maintained modern browser to permanently eliminate exposure to Chakra engine vulnerabilities.
- Implement browser isolation or sandboxing technologies to contain potential exploitation attempts before they reach the operating system.
- Monitor endpoint detection and response (EDR) solutions for indicators of browser-based exploitation, such as anomalous memory allocation patterns or unexpected child processes from the Edge browser.
Technical Details
CVE-2016-7200 is a memory corruption vulnerability (CWE-119) in the Chakra JavaScript engine of Microsoft Edge that occurs when the engine improperly handles objects in memory during JavaScript parsing and execution. The flaw allows an attacker to craft JavaScript code that triggers an out-of-bounds memory access, corrupting heap metadata or adjacent objects in a way that enables controlled writes to arbitrary memory locations. By manipulating the corrupted memory state, the attacker can overwrite critical data structures such as virtual function tables or return addresses, ultimately achieving arbitrary code execution within the Edge renderer process. The attack vector is network-based with low complexity, requiring only that the victim navigate to a page containing the malicious JavaScript payload.
Frequently Asked Questions
Is CVE-2016-7200 being actively exploited?
Yes. CVE-2016-7200 is confirmed as actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 89.2% (98.8th percentile) reflects extremely high real-world exploitation activity.
What products are affected by CVE-2016-7200?
CVE-2016-7200 affects Microsoft Edge on Windows 10 and Windows Server 2016 systems using the original EdgeHTML-based browser with the Chakra JavaScript engine. The Chromium-based Microsoft Edge is not affected.
How do I fix CVE-2016-7200?
Apply the Microsoft security update MS16-129 (November 2016) for Microsoft Edge. For long-term protection, migrate to Microsoft Edge (Chromium) or another modern browser, as the legacy EdgeHTML engine and Chakra are no longer actively supported.
How severe is CVE-2016-7200?
CVE-2016-7200 is rated CRITICAL and allows full remote code execution through a malicious web page. The 98.8th percentile EPSS score and CISA KEV listing confirm this is a high-severity, actively exploited vulnerability requiring urgent remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.