CVE-2018-8289

Exploitation likely. EPSS gives it a 10% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.04.3Medium EPSS percentile96th10% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2018-07-11Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Microsoft EdgeAffected: Windows 10 Version 1803 for 32-bit SystemsUpgrade to: not statedAffected: Windows 10 Version 1803 for x64-based SystemsUpgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your business uses microsoft edge on Windows devices.
Install all available Windows and Microsoft Edge security updates; Microsoft provides remediation for CVE-2018-8289, but the findings do not specify a fixed version number.
Until every device is updated, ask staff to avoid unexpected links and websites sent by email or chat.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8297, CVE-2018-8324, CVE-2018-8325.

In plain language

Written by AI from the record

This is a memory-handling flaw in microsoft edge that can expose limited information if a user opens a malicious webpage; keep the browser fully updated.

Microsoft Edge information disclosure caused by improper handling of objects in memory, remotely triggered with user interaction (CWE-200).

If you're affected

Sensitive information exposure
User privacy loss
Targeted phishing support

What is it

A malicious webpage could take a small peek at information that should stay inside the browser’s memory. It is like a visitor being able to glimpse a few papers left on a desk, rather than being given access to the whole office.

Who is affected

This matters to you if your staff use microsoft edge on company Windows devices. The attack requires someone to open a malicious webpage or link.

How urgent is it

An attacker would need to lure a user to a malicious webpage, so this is an AMBER issue: address it through your normal, prompt update process. There is no record of active exploitation or public exploit code in the findings.

What to do — in detail

Confirm exposure by inventorying Windows endpoints that run microsoft edge and checking their installed Windows security-update status against Microsoft’s advisory. The findings identify vendor remediation but do not provide fixed version numbers or separate supported-version branches; use the Microsoft advisory and your Windows update management tool to deploy the applicable security update.

If patching is delayed, reduce exposure by limiting browsing from sensitive workstations and blocking known malicious web destinations through your web-filtering controls. No CISA KEV remediation due date applies because this CVE is not listed in KEV. Monitor update-deployment failures and browser/security logs for unusual activity following visits to suspicious sites.

Technical context

CVE-2018-8289 is CVSS v3.0 4.3 (Medium): AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. It is CWE-200 information disclosure in Microsoft Edge caused by improper handling of objects in memory. No CISA KEV listing, confirmed exploitation, or public exploit code is recorded in the findings. EPSS predicts a 10.3% likelihood (96th percentile) and is flat; this is predictive rather than evidence of exploitation. Press attention is rising, which does not establish exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

10% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

13 events over 3019 days, from the signal feeds we watch.

2026-10-16EPSS band changelow → moderateepss band change
2026-09-28EPSS band changemoderate → low
2026-09-23EPSS band changemoderate → 0epss band change
2026-09-21EPSS band change0 → moderateepss band change
2026-06-25OpenVAS check added
2024-11-21Patch availablerecord updated

Affected products

Microsoftcommercial · US
- Microsoft EdgeDesktop AppConsumer Software / browser

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Scored 4.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity NoneNo integrity impact
Availability NoneNo availability impact