DEVCORE

Mentions · 7d3
Mentions · 30d3
All mentions3
First seenOct 28, 2026
Last mentioned1d ago

Timeline

3 articles · newest first

Edge exploit chain uses five logic bugs to escape the sandbox

Orange Tsai’s Pwn2Own Berlin chain turns a malicious page into Windows code via UXSS and a writable protocol config, without memory corruption.

Cyber Security Newsupdated Oct 29, 10:37 UTC · 1d agofirst Oct 29, 08:48 UTC · 1d agoExploit / PoC 4 sources2

Logic bugs alone escaped Microsoft Edge at a $175,000 Pwn2Own win

DEVCORE's chain needs no memory corruption and was fixed in Edge 148.0.3967.70 the day after the May contest.

The Hacker Newsupdated Oct 29, 10:37 UTC · 1d agofirst Oct 28, 16:23 UTC · 2d agoResearch 4 sourcesCVE-2026-45492 CVE-2026-45494 CVE-2026-454952

Orange Tsai details logic-only Microsoft Edge full chain from Pwn2Own

DEVCORE used five logic bugs and two Windows features for an Edge sandbox escape, earning $175,000 and a Pwnie award.

Lobsters · securityupdated Oct 29, 10:37 UTC · 1d agofirst Oct 28, 13:34 UTC · 2d agoResearch 4 sources1

Related CVEs

by mentions

CVE-2026-45495<1%9.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
published May 18, 2026microsoft edge chromium
CVE-2026-45494<1%6.1
Microsoft Edge (Chromium-based) Spoofing Vulnerability
published May 18, 2026microsoft edge chromium
CVE-2026-45492<1%5.4
Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network
published May 18, 2026microsoft edge chromium

Appears with

Microsoftvendor · 3
Microsoft Edgeproduct · 2
Zero Day Initiativeorganization · 1
Edgeproduct · 1
Windowsproduct · 1

Entities are extracted by the model from each article. First seen Oct 28, 2026, last mentioned 1d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.