Orange Tsai of DEVCORE on Tuesday published the full details of a Microsoft Edge exploit chain that broke out of the browser’s sandbox using logic bugs alone, with no memory corruption anywhere in the attack.
The chain won $175,000 and 17.5 Master of Pwn points at Pwn2Own Berlin 2026 in May, the single largest payout of the contest’s opening day and the only successful browser entry of the event. Tsai held the technical write-up until Microsoft had patched, releasing it on October 28, five months after the demonstration. The research also won the 2026 Pwnie Award for Epic Achievement at DEF CON in August.
Browser sandbox escapes almost always lean on memory corruption — a crash, a corrupted pointer, a carefully groomed heap. Tsai built this one entirely from logic errors in how Edge and Windows handle everyday features, and he says the whole exploit runs in under 100 lines of code. He also notes he wrote all of it by hand, with no AI assistance, framing the project as a demonstration of where human vulnerability research still has an edge.
The chain starts with an Edge feature for enterprise sign-ins called a conditional access navigation throttle, which lives in the browser process and guides work-account users to the correct profile.
Tsai found that firing it lets the browser’s own process launch a fresh navigation that is never bound to the page that requested it, so Edge simply attaches it to whichever tab is active. That mismatch is the first bug, and it produces a universal cross-site scripting (UXSS) primitive — a way to run JavaScript on any site, even google.com or icloud.com, while ignoring the content security policies that normally stop it.
Turning that into a zero-click attack required four more weaknesses stacked on top of it. Edge checked that the throttle fired from a trusted Microsoft origin, but the check only looked at the current tab, so opening the request from a second window slipped past it. Edge’s pop-up blocker should have killed that second window, except Edge ships a hardcoded allow-list of addresses, and one of them opened the pop-up cleanly.
The attack required the victim to already be signed in, which Edge’s OneAuth auto-sign-in provides the moment a user visits a Microsoft site. And it needed the victim’s email address, which a misconfigured cross-origin setting on assets.msn.com handed to any website that asked.
Running JavaScript everywhere still doesn’t give the machine control, so Tsai turned to Immersive Reader, Edge’s reading mode. Because Microsoft forked it from Chromium early and runs it under a custom read:// scheme, that scheme was left off the list of privileged pages barred from executing script URLs — so the UXSS worked there too.
From inside that privileged page, the chain called an internal Edge function meant to zip up diagnostic logs and abused it, using directory traversal and a null byte, to perform an arbitrary file write that controls both the filename and contents anywhere on disk.
The final step converts that file write into code execution. The chain overwrites a configuration file that governs which origins may launch which protocol handlers, restarts Edge so the file reloads, then fires a telnet:// link. Windows ships no telnet client by default, so it searches the system PATH — including a folder the low-privileged user can write to — and runs an attacker-planted binary. Game over, outside the sandbox.
“The hard part is finding them, and once you find them all, chaining is the easiest part,” Tsai wrote of the logic bugs.
Microsoft shipped the fix on May 15, the day after the contest, in Edge Stable version 148.0.3967.70. The release carried three Edge-specific fixes, tracked as CVE-2026-45492, a security feature bypass; CVE-2026-45494, a spoofing flaw; and CVE-2026-45495. Microsoft rated the first two at 5.4 out of 10 — a medium score that reflects each bug viewed alone, not the full chain that welds them into code execution. DEVCORE said the patch arrived within 24 hours of disclosure.
This was a contest exploit, not an attack seen in the wild, and the public CVE records list no exploitation. The browser restart in the chain is a convenience for the Pwn2Own stage and would not be needed in a real attack, according to Tsai. Any Edge install on automatic updates received the fix months ago and needs no further action; the version to confirm is 148.0.3967.70 or later.
Tsai has said he is close to porting the same logic-only approach to Google Chrome and will present further work at CODE BLUE in Japan.
Community Discussion
Join the conversation. Ask questions, share solutions, and help others.
Be the first to start the discussion!
