Logic bugs alone escaped Microsoft Edge at a $175,000 Pwn2Own win
Original title: Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win
DEVCORE's chain needs no memory corruption and was fixed in Edge 148.0.3967.70 the day after the May contest.
Orange Tsai of DEVCORE published on October 28 the full logic-bug chain that won $175,000 at Pwn2Own Berlin in May. A malicious page could gain universal cross-site scripting inside Edge and then write a file and run code outside the sandbox, without memory corruption. Microsoft shipped fixes the next day in Edge Stable 148.0.3967.70 as CVE-2026-45492, CVE-2026-45494, and CVE-2026-45495. Public records list no exploitation, and an up-to-date browser is not at risk.
Unconfirmed: There is no evidence of use against real users; CVE records list exploitation as none.
- Tsai says the whole exploit is under 100 lines of code.
- Microsoft rates the first two bugs 5.4, not the full chain.
- The first bug is a security feature bypass and the second spoofing.
- One contest step restarts the browser and is not required in a real attack.
- The research won the 2026 Pwnie Award for Epic Achievement.
Impact: code execution outside the Edge sandbox from a web page
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Edge | before 148.0.3967.70 | 148.0.3967.70 |
- 1.Update Microsoft Edge to Stable version 148.0.3967.70 or later.
- Vendors
- Microsoft
- Products
- Microsoft Edge
- Organizations
- DEVCORE
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-45495+2 related CVEs | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 9.8 group max | <1% |
From the original article
3 min read at thehackernews.com
A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on October 28, five months after the chain won $175,000 at the Pwn2Own Berlin contest in May. Microsoft fixed the Edge bugs the day after the contest,
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.