Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win

Security researcher Orange Tsai of DEVCORE has publicly detailed an exploit chain that broke out of Microsoft Edge's sandbox using nothing but logic flaws, no memory corruption at all, five months after it earned $175,000 at Pwn2Own Berlin in May. The chain, under 100 lines of code, misused Edge's conditional access navigation throttle, a hardcoded popup-allowlist, auto-sign-in behavior, and a data leak from assets.msn.com to achieve universal cross-site scripting, then abused the Immersive Reader reading mode and an internal log-zipping function to write an arbitrary file and ultimately hijack a protocol handler for code execution via a planted telnet binary. Microsoft patched the underlying issues, tracked as CVE-2026-45492, CVE-2026-45494 and CVE-2026-45495, the day after the contest in Edge Stable 148.0.3967.70, so browsers on automatic updates are already protected. There is no evidence of real-world exploitation; this was a Pwn2Own demonstration that later won the 2026 Pwnie Award for Epic Achievement.