CVE-2017-0208 json
ChakraCore information disclosure vulnerability
published 2017-04-12 9 y ago modified 2026-06-17 4 mo ago also GHSA-pjpr-2qqp-gprf , EUVD-2022-4786
- cvss
- 4.3
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 15.3%
- EPSS 15.3% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
An information disclosure vulnerability exists in Microsoft Edge when the Chakra scripting engine does not properly handle objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system, a.k.a. "Scripting Engine Information Disclosure Vulnerability."
Patch / fix
- nuget Microsoft.ChakraCore 1.4.3
Exploit prediction
15.28% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
| GitHub | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| nuget | Microsoft.ChakraCore | <1.4.3 |
1.4.3 |
Affected products
- Microsoft Corporation Edge
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
portal.msrc.microsoft.com
/en-US/security-guidance/advisory/CVE-2017-0208
web, patch, vendor-advisory
-
github.com
/chakra-core/ChakraCore/pull/2834
web
-
github.com
/chakra-core/ChakraCore/commit/54d6d085987e2c399863940179db67b594d7f0a3
web
-
securitytracker.com
/id/1038234
vdb-entry
-
securityfocus.com
/bid/97460
vdb-entry, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2017-0208
advisory
-
github.com
/chakra-core/ChakraCore
package
-
web.archive.org
/web/20210124023848/http://www.securityfocus.com/bid/97460
web
-
web.archive.org
/web/20211201121401/http://www.securitytracker.com/id/1038234
web
Sources
- CVE List CVE-2017-0208
- GitHub Advisory GHSA-pjpr-2qqp-gprf
- NVD CVE-2017-0208
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.