Security researcher Orange Tsai of DEVCORE has detailed a Pwn2Own-winning attack chain that achieved code execution outside the Microsoft Edge sandbox using under 100 lines of code without memory corruption.
Learn how logic flaws in business sign-in features, reading mode, and protocol handlers were chained together, and review the Microsoft fixes issued in Edge Stable version 148.0.3967.70.
Orange Tsai from DEVCORE published the method on October 28, 2026, five months after the exploit chain won $175.000 in the Pwn2Own Berlin contest. Microsoft patched the issues in Edge the day after the contest, on May 15, 2026, with the release of Edge Stable version 148.0.3967.70. Users who keep their browser up to date are not at risk.
How did the method work?
Typically, a browser's protected environment is compromised by complex technical errors. In this case, however, the researcher used only errors in the logic of everyday features, creating a chain of less than 100 lines of code.
The attack began by exploiting a business login feature in Edge, which allowed the program to start a new browser session by linking it to an open tab. To accomplish this without any user interaction, four additional factors were required: bypassing controls, using predefined addresses to open windows, automatically logging into services, and a misconfiguration on a company site that exposed the user's email.
Escape and computer control
To escape the browser's protective isolation, the chain used Edge's read mode, which was running under an address that was incorrectly exempted from script restriction rules. From there, it leveraged an internal log file creation function to store a file anywhere on disk.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
Flaw in EDK II could allow code execution before the operating system loads
↗
Then, it replaced a configuration file and restarted the browser to read the new setting, ultimately executing a program from a folder the user had access to.
The correction and the importance of the news
Microsoft included the fixes in the May update, covering issues officially documented under three different codenames. The company rated the first two with a score of 5.4 on a 10-point scale, looking at the individual bugs rather than the overall chain.
This is a method that was demonstrated exclusively live in a competition. There is no evidence that it was ever used in real attacks against users, while the researcher was honored for this research with the Pwnie 2026 award.
G
HACKS.GR / GOOGLE SEARCH
Hacks.gr on Google
Set Hacks.gr as a preferred source.
Preferred source
↗
end of article
Top comments (0)