Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win
Summary: Orange Tsai of DEVCORE published on October 28 a chain of logic flaws, with no memory corruption, that escaped Microsoft Edge's sandbox and ran code on Windows, five months after it won $175,000 at Pwn2Own Berlin in May. The chain used a conditional access navigation throttle, a bypass of Edge's trusted-site check via a second window, a hardcoded popup allowlist, auto-sign-in, a misconfigured cross-origin setting on assets.msn.com, and Immersive Reader's read:// address to write a file and launch a telnet:// handler. Microsoft fixed the bugs on May 15 in Edge Stable 148.0.3967.70 under CVE-2026-45492, CVE-2026-45494, and CVE-2026-45495, and there is no evidence of exploitation in the wild.
Key Takeaway: The whole exploit is under 100 lines of code and needed no memory corruption, so the bugs that matter here are ordinary feature logic that vulnerability scanners and memory-safety hardening were never built to catch. Microsoft rated the individual bugs 5.4 out of 10, a score that reflects each flaw in isolation rather than the full chain to code execution.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-45492CVE-2026-45494CVE-2026-45495
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026