DEVCORE's logic-only Edge sandbox escape earns $175,000 at Pwn2Own Berlin
October 29: GBHackers adds technical detail on the chain's steps, including the OneAuth automatic sign-in, the assets.msn.com CORS email leak, and the edgeFeedbackPrivate.zipDiagnosticLogFiles() path traversal used to overwrite protocols.json.
Orange Tsai published a five-bug logic chain that escapes Edge's sandbox for Windows code execution; Microsoft patched it in Edge 148.0.3967.70.
DEVCORE researcher Orange Tsai published on October 28 a write-up of the Microsoft Edge full chain he used at Pwn2Own Berlin in May, winning $175,000 and 17.5 Master of Pwn points, later a Pwnie Epic Achievement award. The chain combines five logic bugs and two Windows features in under 100 lines of code, with no memory corruption or victim clicks, to gain universal cross-site scripting and then arbitrary file writes and code execution outside the sandbox. Microsoft shipped fixes the day after the contest in Edge Stable 148.0.3967.70 as CVE-2026-45492, CVE-2026-45494 and CVE-2026-45495. Public records list no exploitation; an up-to-date browser is not at risk.
- Chain uses five logic bugs and two Windows features, under 100 lines of code
- Entry point: Edge Conditional Access navigation throttle enables universal cross-site scripting
- CORS misconfiguration on assets.msn.com leaks the signed-in user's email to any site
- Immersive Reader read:// path traversal enables arbitrary file write and protocol hijack
- Fixed in Edge Stable 148.0.3967.70 (CVE-2026-45492, CVE-2026-45494, CVE-2026-45495)
- No exploitation in public records; up-to-date browsers are protected
Timeline
dated events in the reporting · oldest first- May 1, 2026Contest at Pwn2Own Berlin; fixes shipped next day · The Hacker News
- Oct 28, 2026Tsai publishes full technical write-up of the chain · The Hacker News
What each outlet adds
beyond the shared facts- Lobsters · securityZDI confirmed four logic bugs, $175,000 and 17.5 Master of Pwn points; HITCON and Hexacon talks.
- The Hacker NewsPatch version, three CVE identifiers, Microsoft severity ratings, and no-exploitation status.
- Cyber Security NewsStep-by-step chain mechanics: privileged-page JavaScript URLs, popup exception, telnet protocol launch.
- GBHackersNames edgeFeedbackPrivate.zipDiagnosticLogFiles() path traversal, OneAuth sign-in and email-leak detail.
- Vendors
- Microsoft
- Products
- EdgeWindowsMicrosoft Edge
- Organizations
- DEVCOREZero Day Initiative
Coverage
oldest first · one row per article · UTC- · 2d ago
Lobsters · securityFirst report
Orange Tsai details logic-only Microsoft Edge full chain from Pwn2Own
DEVCORE used five logic bugs and two Windows features for an Edge sandbox escape, earning $175,000 and a Pwnie award.
- · 2d ago
The Hacker News
Logic bugs alone escaped Microsoft Edge at a $175,000 Pwn2Own win
DEVCORE's chain needs no memory corruption and was fixed in Edge 148.0.3967.70 the day after the May contest.
- · 1d ago
Cyber Security News
Edge exploit chain uses five logic bugs to escape the sandbox
Orange Tsai’s Pwn2Own Berlin chain turns a malicious page into Windows code via UXSS and a writable protocol config, without memory corruption.
- · 1d ago
GBHackers
Five-bug chain escapes Edge sandbox without memory corruption, earns $175,000 at Pwn2Own
Orange Tsai combined logical flaws in Edge and Windows features to gain code execution from an ordinary web page with no clicks; patch status is unconfirmed.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-45495+2 related CVEs | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 9.8 group max | <1% |