CVE-2017-11870

This vulnerability is like a mistake in how the browser’s JavaScript engine handles data in memory. If someone builds a specially designed webpage, they can trick a user into opening it so the attacker can run code using that user’s own permissions. That’s the same level of access the logged-in user has, so it can lead to malware running and accessing business data.

This matters if you run Windows 10 1703, Windows 10 1709, or Windows Server 1709 and you have Microsoft Edge installed, because Edge uses the ChakraCore scripting engine involved in the bug. It requires no special account permissions from the attacker, but it does require a user to visit a crafted webpage. Treat it as a risk when the vulnerable Edge/ChakraCore setup is reachable via normal browser use—especially if users can be lured into visiting malicious links.

This is AMBER because there are public exploits available and the impact is code execution in the context of the logged-in user. Attackers can use a browser visit (user interaction) as the trigger, so real-world risk is tied to everyday web browsing and phishing. Prioritize patching on affected Windows versions and Edge deployments.