"The hard part is finding them, and once you find them all, chaining is the easiest part," writes Orange Tsai of DEVCORE — describing a five-bug chain of pure logic errors that turned a web page into code running outside Microsoft Edge's sandbox.
Orange Tsai, Pwn2Own, and the prize
Tsai published a full write-up on October 28, five months after the chain won $175,000 at the Pwn2Own Berlin contest in May. He demonstrated the exploit on stage at Pwn2Own; the public record shows no evidence the technique has been used against real users and the CVE records list exploitation as none. The work later won the 2026 Pwnie Award for Epic Achievement.
Tsai says the complete exploit is compact — under 100 lines of code — and he built it by hand over about two months without any AI assistance. DEVCORE reported that Microsoft shipped a fix within 24 hours of disclosure.
How logic flaws — not memory corruption — produced a UXSS primitive
Most browser-to-host compromises rely on memory corruption. This chain did not. Instead, it strings together logic weaknesses in Edge and Windows ordinary behaviors to produce a universal cross-site scripting (UXSS) primitive: the ability to run JavaScript on any website while bypassing a site's content security policy.
The chain begins with an Edge feature for business sign-ins called a conditional access navigation throttle. Tsai found that triggering that feature lets Edge's own process start a new navigation that is no longer tied to the page that requested it. Edge then attaches that new navigation to whichever tab happens to be open, creating the UXSS condition. Because the attack originates from the browser process itself, it can reach sites such as google.com that an ordinary web bug cannot touch.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildThe four auxiliary weaknesses that removed the click and delivered user context
Tsai needed several additional behaviors to make the UXSS work without a user click. First, Edge performed a check that the request originated from a trusted Microsoft site; Tsai bypassed that by opening the request from a second window. Second, Edge's popup blocker should have prevented that second window, but the browser carried a hardcoded allow list and one of the allowed addresses opened the popup. Third, the attack required a signed-in user — Edge's auto-sign-in when visiting a Microsoft site supplied that. Fourth, the chain read the victim's email address from assets.msn.com because that host returned the email to any requesting site due to a misconfigured cross-origin setting.
From script-on-any-site to disk: Immersive Reader and a diagnostic-zip abuse
Getting JavaScript running everywhere still left the exploit confined to the sandbox. To escape it, Tsai used Edge's reading mode, Immersive Reader, which runs under a custom read:// address that Microsoft had left off the list of pages barred from running scripts. From that context the chain called an internal Edge function intended to zip diagnostic logs and abused it to write a file with an attacker-chosen name and content to an arbitrary location on disk.
That single file write was then converted into persistent, out-of-sandbox code execution in two steps: overwrite a configuration file that controls which websites may launch which protocol handlers, then restart Edge so the modified file is read. Finally the chain launched a telnet:// link; because Windows does not ship a telnet program by default, the system searches the PATH for a telnet binary and would run an attacker-planted copy from a folder the low-privileged user can write to. One step in Tsai's demonstration restarts the browser — he notes that restart was a convenience for the contest, not a required part of a real attack.
Microsoft's patching and the practical takeaway for users and defenders
Microsoft shipped the fix on May 15 in Edge Stable version 148.0.3967.70, the day after the Pwn2Own demonstration. That release addressed three Edge-specific issues tracked as CVE-2026-45492, CVE-2026-45494, and CVE-2026-45495. The first is recorded as a security feature bypass and the second as a spoofing bug; both affected Edge versions prior to 148.0.3967.70. Microsoft's records rate the first two at 5.4 on a 10-point scale, a medium score that reflects each bug in isolation rather than the full chained exploit.
Updating Edge closes the chain. Because the fix shipped in May, a browser on automatic updates has long since received it; no separate action is required for up-to-date installations.
What this means for technologists and end users
- Technologists and security teams: The chain is a reminder that logic errors across features can compose into a powerful end-to-end exploit even without memory corruption. Patching and review priorities should consider how separate, lower-severity issues may chain.
- Enterprises and procurement leaders: The exploit originated in an Edge feature for business sign‑ins and used auto-sign-in behavior; teams that enable or customize enterprise authentication flows should verify they run patched browser versions and review any customizations that alter navigation or popup handling.
- End users: An up-to-date Edge is not at risk from this specific chain. Because Microsoft shipped fixes in May, devices that receive automatic browser updates have already been protected.
Tsai frames the work as an argument that human research still matters: finding the individual logic flaws was the hard part, and chaining them followed. The public record shows this was a competition exploit, fixed swiftly after disclosure, and not a weapon currently observed in the wild — but the chain itself highlights a class of attack surface that defenders and product teams will need to consider in future design and review cycles.
