CVE-2017-8731

This vulnerability is like a bug in how Microsoft Edge handles internal “memory objects.” If someone gets you to open a specially prepared webpage, their code can run as your currently logged-in user—meaning it can do things your user account can do, such as installing malware or reading user files. Think of it as a booby-trapped link that turns your browser into a way to get control of the same person using the computer.

This matters if you run Windows 10 version 1607 or Windows Server 2016 with Microsoft Edge installed on those machines. The risk is tied to users being tricked into opening a malicious webpage (user interaction is required). It is not a “default internet-exposed” risk in the typical configuration, so it mainly becomes a concern when an attacker can reach the browsing session through a crafted link or similar social engineering.

This is an AMBER issue: there is public exploit code available, so attackers can turn the flaw into a working attack chain after tricking a user to open a malicious webpage. While it’s not reachable by default in typical configuration, the combination of user interaction plus working exploitation means you should patch affected Edge/Windows installs promptly rather than waiting.