● Covered by 1 source · 1 reportMedium impact1 neutral
Microsoft Edge Full Chain Exploit Uses Only Logic Bugs, No Memory Corruption
Key points
- Orange Tsai exploited Microsoft Edge at Pwn2Own Berlin 2026.
- The exploit used four logic bugs for a sandbox escape.
- No memory corruption or AI was involved in the exploit.
- The exploit earned $175,000 and 17.5 Master of Pwn points.
Logic-Only Exploit Achieved
Orange Tsai from DEVCORE Research Team successfully demonstrated a full chain exploit against Microsoft Edge at Pwn2Own Berlin 2026. The exploit was notable for its exclusive use of logic bugs, bypassing the need for memory corruption vulnerabilities. This approach allowed for a complete sandbox escape within the browser.
Pwn2Own Success and Recognition
The exploit involved chaining five bugs and two Windows features. This achievement resulted in a prize of $175,000 and 17.5 Master of Pwn points for Tsai. The exploit was also nominated for and won the Epic Achievement award at the Pwnie Awards, highlighting its significance in the cybersecurity community.
Focus on Navigation Throttles
The research began by examining Chromium's navigation process, specifically focusing on 'Navigation Throttles'. These throttles operate in the Browser Process and intercept navigation requests. Tsai noted that this area has historically seen fewer than 20 CVEs out of over 3,000 fixed in Google Chrome over five years, suggesting it is an under-examined attack surface.
Edge-Specific Vulnerability
During the investigation of Navigation Throttles, a specific throttle in Microsoft Edge called EdgeCAGuidanceNavigationThrottle was identified. This throttle is associated with Edge's enterprise Entra ID feature, specifically Conditional Access (CA), and is designed to guide users to the correct User Profile when signing in with a work account.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
Orange Tsai of DEVCORE Research Team achieved a full chain exploit against Microsoft Edge at Pwn2Own Berlin 2026, utilizing four logic bugs to bypass the sandbox. This exploit earned $175,000 and 17.5 Master of Pwn points, demonstrating a novel approach to browser exploitation without relying on memory corruption vulnerabilities.