CVE-2016-7201
Microsoft Edge Memory Corruption Vulnerability
Description
CVE-2016-7201 is a critical type confusion vulnerability (CWE-843) in the Chakra JavaScript engine used by Microsoft Edge that allows remote attackers to execute arbitrary code via a specially crafted web page. The flaw occurs when Chakra improperly handles objects in memory, enabling an attacker to corrupt memory and gain code execution in the context of the current user. CISA has added CVE-2016-7201 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 90.1% (97.3rd percentile), this vulnerability poses a severe risk to any system running affected versions of Microsoft Edge.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | edge | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/140382/Microsoft-Edge-chakra.dll-Information-Leak-Type-Confusion.html(Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/94038(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1037245(Broken Link, Third Party Advisory, VDB Entry)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-129(Patch, Vendor Advisory)
- https://github.com/theori-io/chakra-2016-11(Exploit, Third Party Advisory)
- https://www.exploit-db.com/exploits/40784/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/40990/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7201(US Government Resource)
Weakness Type
CWE-843: Access of Resource Using Incompatible Type (Type Confusion)
CWE-843 describes a vulnerability where a program accesses a resource using an incompatible type, leading to undefined behavior such as out-of-bounds memory access or arbitrary code execution. In CVE-2016-7201, the Chakra JavaScript engine in Microsoft Edge incorrectly handles type conversions for certain JavaScript objects, allowing an attacker to trigger a type confusion condition that corrupts memory and enables remote code execution.
Learn more: CWE-843 — Access of Resource Using Incompatible Type
Impact Analysis
CVE-2016-7201 is remotely exploitable through a malicious web page, requiring no authentication from the attacker — only that a user visits or is redirected to the attacker-controlled page. Successful exploitation grants the attacker code execution with the same privileges as the logged-in user, which on many Windows systems means full administrative access to the local machine. Confidentiality, integrity, and availability are all fully compromised: the attacker can steal credentials, install malware, modify or delete files, and pivot to other systems on the network. The type confusion primitive in Chakra is highly reliable for exploitation, and the 97.3rd percentile EPSS score reflects that weaponized exploits are readily available and actively used.
Exploit Maturity
CVE-2016-7201 is confirmed as actively exploited in the wild by CISA and is listed in the Known Exploited Vulnerabilities catalog. The EPSS score of 90.1% (97.3rd percentile) indicates extremely high real-world exploitation probability, consistent with the availability of public proof-of-concept exploits targeting the Chakra engine type confusion. Browser-based exploitation requires minimal attacker infrastructure — a single malicious web page or compromised advertisement is sufficient to trigger the vulnerability at scale.
Remediation
- Apply the Microsoft security update MS16-129 (November 2016) for Microsoft Edge immediately, as this is the vendor-provided fix for CVE-2016-7201.
- If patching is not immediately possible, consider disabling JavaScript execution in Microsoft Edge or restricting browsing to trusted sites only as a temporary mitigation.
- Migrate away from legacy Microsoft Edge (EdgeHTML) to Microsoft Edge (Chromium) or another modern, actively supported browser to eliminate exposure to Chakra engine vulnerabilities entirely.
- Deploy network-level protections such as web content filtering and intrusion detection signatures to block known exploitation attempts targeting CVE-2016-7201.
- Audit endpoint systems for indicators of compromise associated with Chakra exploitation, including unexpected child processes spawned by the Edge browser process.
Technical Details
CVE-2016-7201 is a type confusion vulnerability (CWE-843) in the Chakra JavaScript engine of Microsoft Edge. The flaw arises when Chakra incorrectly determines the type of a JavaScript object during just-in-time (JIT) compilation, leading to a mismatch between the assumed memory layout and the actual object structure. An attacker can craft JavaScript code that triggers this type confusion, causing the engine to interpret one object type as another and enabling controlled out-of-bounds reads and writes in process memory. This memory corruption primitive can be leveraged to overwrite function pointers or virtual table entries, ultimately redirecting execution to attacker-supplied shellcode and achieving full remote code execution in the context of the browser process.
Frequently Asked Questions
Is CVE-2016-7201 being actively exploited?
Yes. CVE-2016-7201 is confirmed as actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 90.1% (97.3rd percentile) reflects widespread exploitation activity targeting the Chakra JavaScript engine in Microsoft Edge.
What products are affected by CVE-2016-7201?
CVE-2016-7201 affects Microsoft Edge on Windows 10 and Windows Server 2016 systems that use the original EdgeHTML-based browser with the Chakra JavaScript engine. Systems running Microsoft Edge (Chromium-based) are not affected.
How do I fix CVE-2016-7201?
Apply the Microsoft security update MS16-129 (November 2016) for Microsoft Edge. The most effective long-term remediation is migrating to Microsoft Edge (Chromium) or another modern browser, as the legacy EdgeHTML engine is no longer actively maintained.
How severe is CVE-2016-7201?
CVE-2016-7201 is rated CRITICAL and enables full remote code execution through a malicious web page with no user interaction beyond visiting the page. The 97.3rd percentile EPSS score and CISA KEV listing confirm this is a high-severity, actively exploited vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.