CVE-2016-7201
ChakraCore RCE Vulnerability
Description
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.
Response & Mitigation
Why act now?
Prioritisation rationale
CVE-2016-7201 enables remote code execution via a crafted web page targeting the Chakra JavaScript engine — a drive-by attack requiring only that a user visit a malicious site in Microsoft Edge. The EPSS score of 79.69 % (99.6th percentile) reflects a very high empirical exploitation probability, and CISA KEV inclusion confirms documented real-world exploitation. Although CISA has not linked this CVE to ransomware campaigns, a successful exploit yields full control of the browser process with potential for sandbox escape and lateral movement. Organisations with large Windows 10 desktop estates — particularly those in NIS2-regulated sectors such as digital infrastructure or public administration — should treat any unpatched Edge installation as an active risk and prioritise patch verification and network-level compensating controls immediately.
Runbook · Step 1
Immediate response (0-24 h)
- Apply the vendor patch: Deploy Microsoft's November 2016 cumulative security update (MS16-129) to all Windows systems running Microsoft Edge — verify whether KB3199057 or the applicable Windows 10 cumulative update for your build is already installed; consult the MS16-129 bulletin for the exact KB number matching your OS version.
- Update ChakraCore NuGet packages: Any application referencing
microsoft.chakracore1.2.0 or 1.2.1 must be upgraded to a patched release (>= 1.3.x) — confirm the exact safe version in the vendor advisory and your NuGet feed before deploying. - Disable or replace Microsoft Edge as the default browser: Until patch deployment is confirmed, enforce a Group Policy (
Computer Configuration > Administrative Templates > Windows Components > Microsoft Edge) that prevents Edge from launching; redirect users to a non-affected browser. - Restrict internet access for high-risk endpoints: Isolate workstations with no legitimate need for Edge-based browsing (kiosk systems, OT jump hosts) from the internet, or funnel all outbound HTTP/HTTPS (ports 80/443) through a proxy with TLS inspection.
- Inventory ChakraCore-dependent server-side applications: Identify any Node.js or server-side workloads embedding ChakraCore and move them to isolated network segments until patched.
Runbook · Step 2
Mitigation layers
- Network segmentation: Place Edge-using endpoints in a dedicated client VLAN; route all outbound web traffic through a proxy with URL categorisation and TLS inspection to break drive-by exploitation chains before the payload reaches the browser.
- Exploit protection (EMET / Windows Defender Exploit Guard): Enable DEP, forced ASLR, and Control Flow Guard for
MicrosoftEdge.exevia EMET 5.5+ or Windows Defender Exploit Guard — CFG is particularly effective against Chakra heap-corruption primitives. - AppLocker / WDAC policy: Block execution of
chakra.dllandchakracore.dllfrom unauthorised paths using Windows Defender Application Control publisher or hash rules. - IPS signature: Configure a Snort/Suricata rule targeting anomalous JavaScript heap-spray patterns in HTTP responses — flag
Content-Type: text/htmlortext/javascriptresponses larger than 200 kB containing high-entropy, repetitive byte sequences consistent with NOP sleds or typed-array spray. - Least-privilege for browser processes: Confirm Edge child processes run at Mandatory Integrity Level "Low"; prevent Edge from spawning with elevated tokens via process-creation audit policies.
- Proxy block list: Enforce threat-intelligence-driven domain blocklists (MISP, sector ISAC feeds) on the web proxy to prevent initial access to attacker-controlled pages hosting the exploit.
Runbook · Step 3
Detection rules
- Sysmon EID 1 — Suspicious child processes of Edge: Alert on process creation where
ParentImageends withMicrosoftEdge.exeorMicrosoftEdgeCP.exeandImageends withpowershell.exe,cmd.exe,wscript.exe, ormshta.exe— Sigma shape:ParentImage|endswith: 'MicrosoftEdge.exe'ANDImage|endswith: 'powershell.exe'. - Windows Event ID 4688 (process creation with command-line auditing): Detect processes spawned from
MicrosoftEdgeCP.exethat immediately establish network connections — KQL:DeviceProcessEvents | where InitiatingProcessFileName =~ "microsoftedgecp.exe" and FileName in~ ("powershell.exe","cmd.exe","wscript.exe"). - Network telemetry (Zeek/Suricata): Flag HTTP responses with
Content-Type: text/javascriptortext/html, payload size > 200 kB, and Shannon entropy > 6.5 bits/byte as potential heap-spray payloads; correlate with the requesting host's browser process. - EDR — memory anomaly: Alert on
chakra.dll-internal ROP gadget chains orVirtualAlloc/VirtualProtectcalls from the Edge renderer process that change memory protection toPAGE_EXECUTE_READWRITE. - Windows Event IDs 1000/1001 (Application Error / WER): Monitor for repeated crashes of
MicrosoftEdge.exereferencingchakra.dllas an indicator of failed exploitation attempts (denial-of-service path) — SPL:source="WinEventLog:Application" EventCode IN (1000,1001) Message="*chakra*".
Metrics
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
nuget
microsoft.chakracore1.2.0
nuget
microsoft.chakracore1.2.1
Public exploit references
Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.
References & sources
- https://nvd.nist.gov/vuln/detail/CVE-2016-7201advisory
- https://github.com/chakra-core/ChakraCore/pull/1982web
- https://github.com/chakra-core/ChakraCore/commit/c2787ef8fdb7401922e9ec6540e4e5895d11c631web
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-129web
- https://github.com/chakra-core/ChakraCorepackage
- https://github.com/theori-io/chakra-2016-11web
- https://web.archive.org/web/20210123185125/http://www.securityfocus.com/bid/94038web
- https://web.archive.org/web/20211126224744/http://www.securitytracker.com/id/1037245web
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7201web
- https://www.exploit-db.com/exploits/40784web
- https://www.exploit-db.com/exploits/40990web
- http://packetstormsecurity.com/files/140382/Microsoft-Edge-chakra.dll-Information-Leak-Type-Confusion.htmlweb
- http://www.securityfocus.com/bid/94038web
- http://www.securitytracker.com/id/1037245web
- https://www.exploit-db.com/exploits/40784/exploitx_refsource_EXPLOIT-DB
- https://www.exploit-db.com/exploits/40990/exploitx_refsource_EXPLOIT-DB