CVE-2017-11861

This vulnerability is like a mistake inside the browser’s “script” interpreter—an attacker can craft a website that triggers the bug after you interact with it. If it works, the attacker can take over your device using the same access rights as the user who clicked/visited the malicious content, which can lead to malware and data theft.

This matters to you if you run Microsoft Edge (with the ChakraCore scripting engine) on Windows 10 1607, 1703, or 1709, or Windows Server 2016/1709. It becomes a risk when a person on your business visits a crafted website or content and interacts with it in the affected browser. The findings do not confirm whether it’s reachable in the default configuration without special conditions, so the safest assumption is: treat it as relevant for any user browsing web content in those environments.

This should be treated as an important, time-sensitive fix (AMBER) because attackers can exploit the browser remotely after user interaction, and public exploit code is available. Even though it’s not listed in CISA’s KEV list, the combination of a known exploit and rising attention means you should remediate promptly on affected devices.