Researcher Cracks Microsoft Edge Using Logic Bugs Without Memory Corruption
A chain of logic flaws bypassed sandbox protections to achieve full code execution.
1Logic Over Memory Corruption
Security researcher Orange Tsai demonstrated a sophisticated exploit chain against Microsoft Edge at the May 2026 Pwn2Own Berlin contest. Unlike traditional browser exploits that rely on memory corruption, this method utilized a series of logic flaws. The entire exploit consisted of under 100 lines of code, proving that logical errors remain potent.
2The Sandbox Escape Mechanism
A browser sandbox typically isolates web content from the underlying operating system. Tsai bypassed this by abusing the Immersive Reader feature, which operated under a custom read:// address lacking proper script restrictions. This allowed the attacker to move from a universal cross-site scripting primitive to executing arbitrary code on the host machine.
3Initial Navigation Throttle Flaw
The attack chain began with a conditional access navigation throttle intended for business sign-ins. Triggering this feature allowed the browser process to initiate a navigation not tied to the originating page. Edge incorrectly attached this to an open tab, creating a mismatch that served as the foundation for the universal cross-site scripting primitive.
4Bypassing Security Policy Checks
To execute the attack without user interaction, Tsai bypassed trusted site checks by opening requests from a secondary window. He exploited a hardcoded list of allowed addresses in the popup blocker to facilitate this. Furthermore, the chain leveraged auto-sign-in features and a misconfigured cross-origin setting on assets.msn.com to retrieve sensitive user email data.
5File System Manipulation Tactics
The exploit abused an internal diagnostic log function to write files to arbitrary disk locations. By overwriting configuration files that manage protocol handlers, the attacker forced the system to execute a malicious telnet:// link. Because Windows lacks a default telnet client, the system searched the path and executed an attacker-planted file instead.
6Rapid Patching and CVE Details
Microsoft addressed the vulnerabilities within 24 hours of the Pwn2Own disclosure. The fixes were included in Edge Stable version 148.0.3967.70, released on May 15. The specific issues are tracked as CVE-2026-45492, CVE-2026-45494, and CVE-2026-45495. These are rated as medium severity individually, though their combined impact in the chain was critical.
7Research Methodology and Recognition
Tsai spent two months manually developing this chain without the assistance of AI tools. He characterizes the work as identifying a new attack surface rather than a singular bug. The research was highly regarded in the security community, ultimately winning the 2026 Pwnie Award for Epic Achievement for its innovative approach.
8Current Security Status Summary
This exploit was a controlled competition demonstration and has not been observed in real-world attacks. Public CVE records confirm no active exploitation. Since the patches were deployed in May 2026, users with browsers on automatic updates are already protected. No manual intervention is required to mitigate the risks posed by this specific chain.