Microsoft Edge Chakra JIT suffers from a missing integer overflow check in Lowerer::LowerSetConcatStrMultiItem.
228fb8eccde76bcdb76fa5519ebb01ea7dcc1657dfc57e85ceb5485b7c3cfc13
This Microsoft bulletin summary lists major revision increments for over a dozen CVEs that have been addressed.
5848181ca8df9846260988604002ca7b59b0a857b7d4dedf4caeae500c687777