A recent exploit showcased at the Pwn2Own Berlin contest demonstrated how a sequence of logic errors could breach Microsoft Edge’s sandbox without memory corruption. This groundbreaking method was detailed by Orange Tsai from DEVCORE, who published the full technique five months after it won $175,000 at the competition held in May. Microsoft swiftly addressed the vulnerabilities, ensuring updated browsers remain secure.
Exploit Methodology and Impact
The sandbox within a browser acts as a barrier, preventing web page code from impacting the broader computer system. Traditionally, memory corruption is pivotal for such breaches. However, Tsai’s exploit relied solely on logic errors within Edge and Windows, utilizing less than 100 lines of code. The result was a universal cross-site scripting (UXSS) capability, enabling JavaScript execution across any site, bypassing standard content security policies.
This vulnerability initiated from within the browser’s own process, allowing access to sites like google.com which are typically out of reach for standard web bugs. Tsai emphasized this as a novel attack surface rather than an isolated flaw.
Details of the Exploit Chain
Tsai’s demonstration at Pwn2Own clarified that this exploit was not observed in real-world attacks and was primarily for competition purposes. The chain started with a feature in Edge designed for business sign-ins, known as a conditional access navigation throttle. Through this, a new navigation was triggered, decoupled from its originating page, leading to the initial UXSS vulnerability.
Further exploitation involved bypassing Edge’s security measures through additional logic errors, including exploiting a misconfigured cross-origin setting on Microsoft’s assets.msn.com to extract email addresses. The use of Edge’s Immersive Reader mode allowed further sandbox escape, culminating in the overwriting of configuration files to execute code on the system.
Implications and Microsoft’s Response
On May 15, a day after the contest, Microsoft released updates to address the identified vulnerabilities, recorded as CVE-2026-45492, CVE-2026-45494, and CVE-2026-45495. These updates were part of Edge Stable version 148.0.3967.70, mitigating the risks posed by the exploit chain. While the individual bugs were rated moderately on the vulnerability scale, the collective chain demonstrated significant potential for exploitation.
The swift patching by Microsoft means that users with automatic updates have received the necessary security enhancements, ensuring protection against this exploit. Tsai’s work, which earned the 2026 Pwnie Award for Epic Achievement, underscores the continued importance of human expertise in uncovering and addressing complex security challenges.
