Intel

CVE-2016-7200

ChakraCore RCE Vulnerability

criticalKEV: actively exploitedPoCEPSS 82%

Description

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7201, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.

Source: OSVCISA_KEVCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2016-7200 is a memory-corruption flaw in the Chakra JIT engine that enables remote code execution simply by luring a user to a malicious webpage — no additional interaction beyond the page visit is required, making it an ideal drive-by initial-access vector. The EPSS score of 0.82 (99.6th percentile) reflects the availability of reliable exploit code and confirmed exploitation activity. Although CISA has not linked this CVE to a known ransomware campaign, the drive-by RCE primitive is routinely used as the first stage of multi-phase intrusions targeting enterprise workstations. NIS2-scoped organisations running Windows 10 with Edge as the default browser, or shipping products that embed ChakraCore 1.2.x, should treat patch deployment as a P1 obligation and validate coverage before closing the ticket.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch: Deploy Microsoft's November 2016 security update for CVE-2016-7200 (MS16-129) immediately on all Windows 10 systems running Microsoft Edge. Confirm the exact KB number via the Microsoft Security Response Center advisory MS16-129.
  • Update ChakraCore NuGet packages: Any application referencing microsoft.chakracore 1.2.0 or 1.2.1 must be rebuilt against a patched release — verify the target version in the NuGet package listing or the ChakraCore GitHub Releases page.
  • Remove Edge as the default browser on systems where the patch cannot be deployed immediately; redirect users to a non-affected browser until the update is in place.
  • Restrict internet browsing for unpatched workstations: Enforce a proxy allowlist or DNS sinkhole for uncategorised domains to reduce the drive-by attack surface while patching is in progress.
  • Scan build artefacts and CI/CD pipelines for transitive dependencies on microsoft.chakracore 1.2.0/1.2.1 using dotnet list package --vulnerable or OWASP Dependency-Check; treat any hit as a blocker for production deployment.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Place workstations in a dedicated client VLAN with egress filtered through a categorising proxy. Block direct internet access for privileged accounts (admins, service accounts) entirely.
  • Exploit Guard hardening: Enable Windows Defender Exploit Guard on all Edge hosts with Arbitrary Code Guard (ACG) and "Block low-integrity images" applied to MicrosoftEdge.exe and MicrosoftEdgeCP.exe. ACG significantly raises the cost of JIT-spray attacks against the Chakra engine.
  • AppLocker / WDAC policy: Block execution of unsigned binaries and scripts dropped into the Edge package cache (%LocalAppData%\Packages\Microsoft.MicrosoftEdge_*) via AppLocker or Windows Defender Application Control rules.
  • IPS signatures: Keep Suricata/Snort ET EXPLOIT browser-exploit rule sets current; add local rules to flag HTTP responses with JavaScript payloads exceeding 5 MB from newly observed domains.
  • Least privilege: Confirm that Edge processes run under standard user accounts with no local admin rights; set UAC to "Always notify." This limits post-exploitation blast radius to the user context.
  • Embedded ChakraCore in custom applications: Replace the bundled library with a patched build or disable the affected scripting functionality until an update can be shipped.

Runbook · Step 3

Detection rules

  • Sysmon EID 1 — suspicious child processes: Alert on cmd.exe, powershell.exe, wscript.exe, or mshta.exe spawned directly by MicrosoftEdgeCP.exe. 
    Sigma-shape: process_creation | where ParentImage endswith 'MicrosoftEdgeCP.exe' and Image endswith ('cmd.exe','powershell.exe','wscript.exe')
  • Sysmon EID 10 — process access: Flag any access to lsass.exe or other privileged processes where the calling process is in the Edge process tree; treat as P1.
  • Windows Event ID 4688 (process creation with command line): Correlate command lines containing Base64 blobs or download cradles (IEX, DownloadString, certutil -decode) where the parent process is Edge. 
    KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "MicrosoftEdgeCP.exe" and ProcessCommandLine matches regex @"(?i)(iex|downloadstring|certutil.*decode)"
  • Network telemetry (Zeek/Suricata): Flag HTTP responses with Content-Type: application/javascript or large inline <script> blocks (> 2 MB) originating from domains seen for the first time in your environment.
  • EDR memory-anomaly alerts: Treat any Microsoft Defender for Endpoint alert categorised as "Exploit" with high severity on MicrosoftEdge.exe or MicrosoftEdgeCP.exe as a confirmed P1 incident requiring immediate isolation of the affected host.

Metrics

Severity
critical
Priority score
161.10
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
—
CVSS v3
—
CVSS v4
—
EPSS percentile
99.6 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
82.5 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2022-05-14 02:22 UTC
CWE
—

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • nuget

    microsoft.chakracore1.2.0

  • nuget

    microsoft.chakracore1.2.1

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2016-7200