EXPOSURES › CVE-2016-7200
CVE-2016-7200
HIGH ⌖ ON CISA KEV · EXPLOITEDA memory corruption flaw in Microsoft Edge's Chakra engine allowed remote code execution via a crafted website.
This vulnerability enabled remote attackers to execute arbitrary code on affected systems, posing a severe risk to DIB organizations relying on Edge for web browsing. The flaw was actively exploited in the wild, indicating a failure to patch known vulnerabilities before exploitation. DIBs must ensure all Edge instances are updated to the latest patched versions and consider alternative browsers for sensitive operations.
Shame score — A known memory corruption vulnerability in a widely used browser was actively exploited in the wild, demonstrating a failure to patch before exploitation and exposing DIB systems to remote code execution.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |