Edge exploit chain uses five logic bugs to escape the sandbox
Original title: Microsoft Edge Zero-Click Exploit Chains Five Flaws to Execute Code and Escape Sandbox
Orange Tsai’s Pwn2Own Berlin chain turns a malicious page into Windows code via UXSS and a writable protocol config, without memory corruption.
DEVCORE researcher Orange Tsai published on October 28, 2026 an Edge exploit built for Pwn2Own Berlin 2026 that chains five bugs and two Windows features. A Conditional Access navigation flaw creates universal cross-site scripting by running script in the active tab, and further logic bugs plus OneAuth and an assets.msn.com CORS issue remove extra clicks after malicious content loads. Immersive Reader path handling then writes files and changes protocols.json so a webpage can launch telnet and run a planted executable outside the sandbox. The write-up says the finished exploit was under 100 lines and did not use memory corruption.
Unconfirmed: The text does not say whether Microsoft has patched the bugs or whether they are exploited outside the contest.
- The chain starts in Edge’s Conditional Access navigation handler and is not bound to the original tab.
- Browser-process navigation was reported to bypass Content Security Policy.
- A hardcoded popup exception opened a window without the usual user click.
- The read:// scheme was missing from the block list for JavaScript URLs on privileged pages.
- No CVE identifiers or fixed Edge versions are stated in the report.
Impact: Code execution on Windows outside the Edge sandbox
| Product | Affected |
|---|---|
| Microsoft Edge | — |
- 1.Keep Edge updated through Microsoft’s security releases.
From the original article
2 min read at cybersecuritynews.com
Security researcher Orange Tsai has revealed an exploit chain for Microsoft Edge that combines five bugs and two Windows features to run code outside the browser sandbox. Published on October 28, 2026, the research shows how flaws in browser logic can turn a malicious webpage into code execution on Windows without memory corruption. Tsai, a […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.