Orange Tsai details logic-only Microsoft Edge full chain from Pwn2Own
Original title: Forging a Microsoft Edge Full Chain with Logic Bugs Only
DEVCORE used five logic bugs and two Windows features for an Edge sandbox escape, earning $175,000 and a Pwnie award.
Orange Tsai of DEVCORE published a write-up of a handmade Microsoft Edge full chain built for Pwn2Own Berlin 2026. The chain uses five logic bugs and two Windows features, with no memory corruption, to escape the sandbox. The Zero Day Initiative confirmed four logic bugs, a $175,000 award and 17.5 Master of Pwn points. The work later won a Pwnie Awards Epic Achievement award.
Unconfirmed: The post does not say whether Microsoft patched the bugs or assigned CVE identifiers.
- An Edge Conditional Access throttle accepts an attacker-controlled switch_profile URL.
- A sourceless browser-process navigation followed the active tab and produced UXSS.
- Tsai says fewer than 20 of 3,000-plus Chrome CVEs in five years involved navigation throttles.
- He presented the hunting and chaining process at HITCON and Hexacon.
Impact: Edge sandbox escape through chained logic bugs
| Product | Affected |
|---|---|
| Microsoft Edge | — |
- Vendors
- Microsoft
- Products
- Microsoft Edge
- Organizations
- DEVCOREZero Day Initiative
From the original article
14 min read at blog.orange.tw
I think I should still dump some of my work once in a while, even though it feels like fewer and fewer people actually sit down and read articles these days (or maybe now they all leave it to their agents XD). Anyway, this is what I built for Pwn2Own Berlin 2026 — a completely handmade, logic-only Microsoft Edge Full Chain, with no memory corruption, and no AI at all! 🔥 Confirmed!
By blog.orange.tw via polywolf · blog.orange.tw
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.