CVE-2017-11840

This is a security weakness in the JavaScript engine inside Microsoft Edge (ChakraCore). If a user is tricked into interacting with a malicious webpage, attackers can cause a crash-like memory problem and then run harmful code as the same user currently signed into Windows—like handing the keys to your office desk to whoever wrote the note that fooled you.

This matters if you run Microsoft Edge on Windows versions listed in the CVE (Windows 10 Gold 1511, 1607, 1703, 1709; Windows Server 2016; Windows Server 1709) where ChakraCore is used by the browser. It does not require an attacker to have an existing login, but it does require user interaction—typically the victim visiting and engaging with crafted web content. This is a risk only when that browser engine is reachable in your setup and the attacker can get a user to interact with malicious web content.

Treat this as urgent enough to patch soon: public exploit code exists and attackers can use a website to trigger code execution as the logged-in user. Even though the known victim path requires user interaction (so it’s not automatic), the potential impact is full user-level compromise, so you should update your affected Windows/Edge environments without delay.