Logic Bugs Alone Allowed Pwn2Own Win Against Microsoft Edge
A security researcher exploited a chain of logic flaws in Microsoft Edge, bypassing its sandbox without memory corruption, to win $175,000 at Pwn2Own Berlin.
A security researcher has demonstrated a sophisticated attack chain that leveraged only logic bugs to achieve code execution outside the Microsoft Edge browser sandbox, a feat that earned $175,000 at the Pwn2Own Berlin contest. Orange Tsai of DEVCORE detailed the exploit, which was patched by Microsoft shortly after the competition concluded in May. The vulnerability chain, comprising fewer than 100 lines of code, highlights the potential for purely logic-based flaws to compromise systems, a departure from the more common memory corruption exploits.
The browser sandbox is a critical security mechanism designed to isolate web content and prevent malicious code from accessing a user's system. Breaking out of this sandbox is a key objective for attackers seeking to gain control of a machine. Traditionally, such escapes heavily rely on memory corruption vulnerabilities, making Tsai's approach particularly noteworthy for its reliance on the intricate handling of ordinary browser and operating system features.
At the heart of the exploit was a universal cross-site scripting (UXSS) primitive, enabling JavaScript execution on any website, even those protected by Content Security Policies (CSP). This primitive allowed the attack to originate from the browser's own process, granting it access to sensitive sites that standard web exploits typically cannot reach. Tsai characterized this as a novel attack surface rather than an isolated bug.
While the exploit was demonstrated in a controlled contest environment and there is no evidence of it being used in the wild, its technical depth is significant. One component of the chain involved restarting the browser, a convenience for the contest but not a necessity for a real-world attack. The initial vulnerability stemmed from a conditional access navigation throttle feature within Edge, used for business sign-ins. By triggering this feature, Tsai could initiate a new navigation that was detached from the originating page, effectively hijacking the tab context.
Achieving execution without user interaction required overcoming several additional security measures. Edge's checks for trusted Microsoft sites were bypassed by opening the malicious request from a secondary window. Furthermore, Edge's popup blocker was circumvented by exploiting a hardcoded list of allowed addresses, one of which permitted the popup to open. The attack also leveraged Edge's auto-sign-in feature, which automatically logs users into Microsoft sites, and a misconfigured cross-origin setting on assets.msn.com that exposed the victim's email address.
The final stage of the exploit involved escaping the sandbox by abusing Edge's Immersive Reader mode. This feature, accessible via a custom read:// address, was not included in the list of pages barred from script execution. From within Immersive Reader, Tsai utilized an internal Edge function designed for zipping diagnostic logs. This function was manipulated to write an attacker-chosen file to any location on the disk.
This file write capability was then converted into code execution. The attack overwrote a configuration file that dictates which websites can launch specific protocol handlers. Upon restarting Edge, the modified file was read, and a telnet:// link was launched. Since Windows does not include a default telnet client, the system searched the path for an executable, allowing an attacker-planted copy to run with the privileges of the low-privileged user.
Microsoft addressed these vulnerabilities with the release of Edge Stable version 148.0.3967.70 on May 15, the day after the Pwn2Own contest. The update included three Edge-specific fixes, tracked as CVE-2026-45492 and CVE-2026-45494, rated at a medium severity of 5.4. The first is classified as a security feature bypass, and the second as a spoofing bug. The prompt patching within 24 hours of disclosure underscores the importance of such bug bounty programs. Users with automatic updates enabled would have received the fix without any manual intervention.