Chakra Scripting Engine Memory Corruption in Microsoft Edge

Small standalone proof-of-concept repository for Microsoft Edge Chakra exploitation. It contains two exploit HTML files under exploit/: a full RCE variant and a debugging variant without meaningful shellcode. The README identifies the bug chain as CVE-2016-7200 (Array.filter info leak) plus CVE-2016-7201 (FillFromPrototypes type confusion), tested on Windows 10 Edge. Repository structure is minimal: LICENSE, README.md, and two HTML exploit pages. Both HTML files embed JavaScript that relies on an external long.min.js library for 64-bit arithmetic. The code first uses PutDataAndGetAddr() to exploit the Array.filter species confusion/info leak and recover object addresses. It then uses TriggerFillFromPrototypesBug() to corrupt a DataView-like object and establish arbitrary memory read/write primitives via Read32/Read64/Write32/Write64. After gaining memory access, the exploit reads a vtable pointer to derive chakra.dll base, reads a thread context pointer from a hardcoded module offset, derives the stack region, and scans the stack for a known return address inside ScriptEngine::ExecutePendingScripts. Once found, it overwrites the saved return address with a crafted ROP chain. In the NoSC variant, the ROP chain explicitly prepares arguments for VirtualProtect, marks the shellcode page executable, and returns into a buffer containing 0xCCCC bytes. In the full variant, the embedded shellcode is much larger; per README it ultimately calls WinExec to launch notepad.exe. There are no external network callbacks, C2 endpoints, or hardcoded remote hosts. The exploit is delivered as a local/served HTML page and targets the browser process directly. Because it includes a working payload and hardcoded Chakra offsets rather than a reusable framework, it is best classified as an operational standalone browser RCE proof-of-concept.

This repository contains a proof-of-concept exploit for two vulnerabilities in Microsoft Edge's Chakra JavaScript engine (CVE-2016-7200 and CVE-2016-7201). The exploit is delivered as HTML/JavaScript files intended to be served from a web server and accessed by a vulnerable Edge browser on Windows 10. The main file, 'FillFromPrototypes_TypeConfusion.html', demonstrates remote code execution by exploiting a type confusion and info leak to execute arbitrary shellcode, specifically launching notepad.exe. The alternate file, 'FillFromPrototypes_TypeConfusion_NoSC.html', is a variant that triggers a software breakpoint (INT 3) for debugging purposes. The exploit leverages advanced JavaScript techniques to manipulate memory and achieve code execution. The repository is structured with a LICENSE, README, and two exploit files under the 'exploit/' directory. No hardcoded network endpoints or external IPs are present; the attack vector is browser-based, requiring the victim to visit the malicious HTML page.