CVE-2017-11918

This vulnerability is in the JavaScript (scripting) engine used by Microsoft Edge. An attacker can use a specially crafted input to corrupt memory and then run code as the same user currently logged into Windows. Think of it like breaking into a locked room and then using the privileges of whoever is already inside the building.

This matters if you run Microsoft Edge on Windows 10 Gold (1511, 1607, 1703, 1709) or Windows Server 2016 where ChakraCore is present. If a user visits a maliciously prepared page or content that triggers the bug, the attacker can act with that user’s permissions. The exposure is only a real risk when the vulnerable Edge/ChakraCore code path is reachable on the affected Windows versions, and attackers have a way to get the victim to load the triggering content.

This is an AMBER issue because there is a public exploit available and attackers can gain control under the current user’s permissions. While it’s not listed in the CISA KEV and exploitation isn’t confirmed by KEV here, the availability of weaponized code makes timely patching important. Press attention is rising, but the decisive factor for urgency is the known public exploit.