Microsoft Browser Memory Corruption Vulnerability (CVE-2020-0878)

What is affected, what to do

<p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft Edge (EdgeHTML-based) gte 1.0..0..*
• Microsoft Internet Explorer 9 gte 1.0.0..*
• Microsoft Internet Explorer 11 gte 1.0.0..*

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Build an inventory: identify every endpoint with active Internet Explorer 9/11, Microsoft Edge (EdgeHTML / "Edge Legacy"), or ChakraCore embedded in line-of-business applications (EDR/software inventory, Get-WindowsOptionalFeature -Online -FeatureName Internet-Explorer-Optional-amd64). Prioritise OT operator stations, kiosks, Windows LTSC images and servers with interactive sessions.
   • Deploy the Microsoft security update for CVE-2020-0878 to all affected Windows builds. A patch is available from the vendor; look up the exact KB for each Windows version in the Microsoft Security Update Guide. Confirm deployment through WSUS/Intune/ConfigMgr compliance reporting.
   • Edge Legacy (EdgeHTML) is end-of-life. Wherever it remains, replace it with Chromium-based Microsoft Edge, which removes the vulnerable EdgeHTML path.
   • Disable Internet Explorer 11 as a standalone browser via GPO/Intune ("Disable Internet Explorer 11 as a standalone browser"), or remove the optional feature where no business application strictly requires it.
   • Strip local admin rights from standard users and enforce LAPS. Code runs as the logged-on user, so an admin session means full host compromise.
   • Ask vendors of applications that embed ChakraCore (in-house or third-party) to confirm they ship an updated library build.
2. 02

   Runbook step 2

   Mitigation layers

   • Configuration/browser: Allow Edge IE mode only through a tight Enterprise Mode Site List limited to approved internal URLs, and block MSHTML rendering for internet destinations. Set the IE Internet zone to "High" or disable Active Scripting for that zone.
   • Network/web gateway: On the proxy, block or warn-page the Trident/7.0 / MSIE user agents and EdgeHTML (Edge/1[2-8]) for internet destinations. Filter ad networks and newly registered domains to counter malvertising. Cut internet access entirely for legacy hosts in OT and kiosk segments.
   • Endpoint hardening: Use WDAC/AppLocker or an EDR custom block rule to stop cmd.exe, powershell.exe, mshta.exe, wscript.exe and rundll32.exe from spawning as children of iexplore.exe or MicrosoftEdgeCP.exe. Enforce Exploit Protection (CFG, DEP, mandatory ASLR) for iexplore.exe.
   • IAM/least privilege: Use separate admin accounts with no browsing or email (tiering model). Prohibit browser sessions on domain controllers and jump hosts.
   • Email security: Rewrite and sandbox-detonate links in inbound mail, since exploitation depends on a user clicking a lure.
3. 03

   Runbook step 3

   Detection rules

   • Process ancestry (Sysmon EID 1 / Security 4688): Suspicious browser child processes. KQL: DeviceProcessEvents | where InitiatingProcessFileName in~ ("iexplore.exe","MicrosoftEdgeCP.exe") and FileName in~ ("cmd.exe","powershell.exe","mshta.exe","rundll32.exe","regsvr32.exe","wscript.exe")
   • Crash telemetry (Application Event ID 1000/1001, WER): Repeated crashes of iexplore.exe or MicrosoftEdgeCP.exe with faulting module jscript9.dll, chakra.dll or mshtml.dll often indicate failed memory-corruption attempts. Correlate these with the external URLs visited immediately beforehand.
   • File system (Sysmon EID 11): Executable content (.exe, .dll, .hta, .js) written by the browser process to %TEMP%, %APPDATA% or INetCache, followed by its execution (EID 1) within minutes.
   • Network (proxy / Zeek http.log): Trident/7.0 user-agent requests to external, newly registered or uncategorised domains. Sigma shape: logsource: proxy | selection: c-useragent|contains: 'Trident/7.0' and not cs-host|endswith: <internal domains>.
   • Follow-on activity: New local accounts (Security 4720/4732) or Run-key persistence (Sysmon EID 13) shortly after browser activity by the same user.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

<p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, the attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers, and then convince a user to view the website. The attacker could also take advantage of compromised websites, or websites that accept or host user-provided content or advertisements, by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically via an enticement in email or instant message, or by getting them to open an email attachment.</p> <p>The security update addresses the vulnerability by modifying how Microsoft browsers handle objects in memory.</p>

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE), CSA/SingCERT

Vendors and products

• Microsoft Microsoft ChakraCore
• Microsoft Microsoft Edge
• Microsoft Microsoft Internet Explorer
• Microsoft Internet Explorer 11
• Microsoft Internet Explorer 9
• Microsoft Microsoft Edge (edgehtml-based)

Weakness classes (CWE)

• CWE-787Out-of-bounds Write

  Base

  The product writes data past the end, or before the beginning, of the intended buffer.

  Entry at MITRE CWE-787

References & sources

• portal.msrc.microsoft.comen-US/security-guidance/advisory/CVE-2020-0878x_refsource_MISC, Patch, Vendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0878government-resource, US government resource