Five-bug chain escapes Edge sandbox without memory corruption, earns $175,000 at Pwn2Own
Original title: Microsoft Edge Security Flaws Allow Attackers to Execute Code Without Memory Corruption
Orange Tsai combined logical flaws in Edge and Windows features to gain code execution from an ordinary web page with no clicks; patch status is unconfirmed.
DEVCORE researcher Orange Tsai published a full exploit chain for Microsoft Edge that escapes the browser sandbox and executes code on Windows using only logical vulnerabilities, with no memory corruption. Built for Pwn2Own Berlin 2026, where it earned a $175,000 award and later an Epic Achievement Pwnie, the chain combines five bugs and two Windows features in under 100 lines of code. The entry point is Edge's EdgeCAGuidanceNavigationThrottle, which enabled universal cross-site scripting on privileged pages via the read:// scheme. Additional bypasses, a OneAuth automatic sign-in, an email leak via a CORS misconfiguration on assets.msn.com, and path traversal in edgeFeedbackPrivate.zipDiagnosticLogFiles() yielded an arbitrary file write that Tsai used to overwrite protocols.json and launch a planted executable. The chain works without any victim interaction once a web page is visited.
Unconfirmed: Patch details for the specific chain could not be confirmed from the sources reviewed.
- The exploit chain earned $175,000 at Pwn2Own Berlin 2026 and a Pwnie Epic Achievement award.
- It combines five bugs and two Windows features in under 100 lines of code.
- A CORS misconfiguration on assets.msn.com leaks the signed-in user's email to any website.
- Edge's Immersive Reader read:// scheme was missing from the blocklist blocking JavaScript URLs on privileged pages.
Impact: sandbox escape and arbitrary code execution on Windows from a web page
| Product | Affected |
|---|---|
| Microsoft Edge | — |
- 1.Check Microsoft advisories for fixes covering the bugs in this exploit chain.
- Vendors
- Microsoft
From the original article
2 min read at gbhackers.com
Researcher Orange Tsai from DEVCORE has published a complete exploit chain for Microsoft Edge that successfully escapes the browser’s sandbox and executes code on Windows. This exploit utilizes only logical vulnerabilities and does not involve any memory corruption. Tsai developed it for Pwn2Own Berlin 2026, where it earned a $175,000 award and later received the […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.