Microsoft Issues Emergency Fix for IE Zero Day

Summary: Microsoft released an emergency patch for a critical Internet Explorer vulnerability, CVE-2018-8653, after Google reported that the flaw was being used in targeted attacks. The vulnerability affects IE 11 on Windows 7 through Windows 10 and Windows Server 2012, 2016 and 2019, IE 9 on Windows Server 2008, and IE 10 on Windows Server 2012, and can be exploited by getting a user to visit a hacked or booby-trapped website.
What's compelling: Attackers exploiting this flaw can install programs, view, change or delete data, or create new accounts with full user rights - and Microsoft learned of it only after Google reported it was already in use in targeted attacks.

Read the original at Krebs on Security ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2018-8653
Related: CVE-2018-8653: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
Patch Tuesday, January 2019 Edition Cyber Risks ·
New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026