No Memory Corruption Needed: How Five Logic Bugs Broke Microsoft Edge for $175,000 at Pwn2Own 2026
Executive Summary
In May 2026, security researcher Orange Tsai of DEVCORE won $175,000 at Pwn2Own Berlin by chaining five logic flaws in Microsoft Edge to achieve a full sandbox escape and remote code execution—without a single memory-corruption bug. The exploit, under 100 lines of code, began with a misconfigured conditional access navigation throttle to generate a universal cross-site scripting primitive, leveraged a hardcoded allowlist bypass, an auto-sign-in feature, and a misconfigured CORS header on assets.msn.com, then used Edge's Immersive Reader and a diagnostic log-zip function to write arbitrary files to disk, ultimately hijacking the telnet:// protocol handler to execute attacker-planted code. Microsoft patched the three CVEs (CVE-2026-45492, CVE-2026-45494, CVE-2026-45495) within 24 hours in Edge 148.0.3967.70.
This exploit signals a paradigm shift in browser attack research: logic-only chains that produce full code execution are now viable, lowering the technical barrier for sophisticated threat actors who previously required rare memory-corruption primitives. As enterprise browsers become identity and SaaS gateways, logic-abuse chains targeting browser features represent a growing and underappreciated attack surface demanding renewed focus on egress controls, sandbox telemetry, and east-west traffic inspection.
Why This Matters Now
Browser-based logic exploit chains are emerging as a preferred technique because they evade memory-hardening defenses like ASLR and CFG that have made classic memory-corruption exploits increasingly difficult. With enterprises relying on Edge for SSO and SaaS access, a single malicious page can now pivot from the browser into cloud workloads, making network-layer egress enforcement and lateral movement detection critical compensating controls—especially as similar logic-chaining TTPs are being adopted by nation-state and ransomware actors.
Attack Path Analysis
An attacker delivered a malicious web page to a signed-in Edge user, exploiting a chain of logic bugs — including a conditional access navigation throttle flaw, a hardcoded popup allowlist bypass, a misconfigured CORS header on assets.msn.com, and an unsandboxed Immersive Reader context — to achieve universal cross-site scripting and then full sandbox escape. By abusing an internal Edge diagnostic function to write arbitrary files, overwriting protocol handler configuration, and planting a malicious telnet binary in a user-writable path, the attacker achieved code execution on the host OS outside the browser sandbox, resulting in full endpoint compromise with no memory corruption required.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
The victim visits a malicious web page while signed into Microsoft Edge with an active Microsoft account. The attacker exploits CVE-2026-45492 (security feature bypass in the conditional access navigation throttle) and CVE-2026-45494 (spoofing bug) to trigger a cross-origin navigation not bound to the originating page. A hardcoded popup allowlist entry in Edge permits the attacker to open a second window bypassing the popup blocker. The Edge auto-sign-in feature and a misconfigured CORS header on assets.msn.com allow the attacker to harvest the victim's email address, satisfying the signed-in precondition silently. This produces a UXSS primitive enabling arbitrary JavaScript execution across all origins including google.com.
Related CVEs
CVE-2026-45492
CVSS 5.4A security feature bypass vulnerability in Microsoft Edge (Chromium-based) before version 148.0.3967.70 allows a remote attacker to bypass browser security controls via a logic flaw in conditional access navigation handling, enabling universal cross-site scripting as part of a multi-stage exploit chain.
Affected Products:
Microsoft Microsoft Edge (Chromium-based) – < 148.0.3967.70
Exploit Status:
no public exploitCVE-2026-45494
CVSS 6.1A spoofing vulnerability in Microsoft Edge (Chromium-based) before version 148.0.3967.70 allows a remote attacker to spoof content or bypass origin validation checks through a logic flaw in popup window handling and trusted address allowlisting.
Affected Products:
Microsoft Microsoft Edge (Chromium-based) – < 148.0.3967.70
Exploit Status:
no public exploitCVE-2026-45495
CVSS 9.8A logic vulnerability in Microsoft Edge (Chromium-based) before version 148.0.3967.70 allows an attacker to abuse Immersive Reader and internal diagnostic log functions to write arbitrary files to disk and achieve sandbox escape and code execution when chained with other vulnerabilities.
Affected Products:
Microsoft Microsoft Edge (Chromium-based) – < 148.0.3967.70
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Drive-by Compromise
Command and Scripting Interpreter: JavaScript
Browser Session Hijacking
Exploitation for Defense Evasion
Hijack Execution Flow: Path Interception by PATH Environment Variable
File and Directory Permissions Modification
Process Injection
Exploitation for Client Execution
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
CISA Zero Trust Maturity Model 2.0 – Least-Privilege Application Execution and Sandbox Integrity
Control ID: Application Pillar – Application Access
NIST SP 800-53 Rev 5 – Malicious Code Protection, Software Integrity, and Process Isolation
Control ID: SI-3, SI-7, SC-39
NIS2 Directive – Security of Network and Information Systems, Vulnerability Handling
Control ID: Article 21 – Cybersecurity Risk Management Measures
PCI DSS 4.0 – Timely Patching of Externally Facing and Client-Side Software
Control ID: Requirement 6.3 – Security Vulnerabilities are Identified and Addressed
DORA (Digital Operational Resilience Act) – Browser and Endpoint Security Configuration Management
Control ID: Article 9 – ICT Security Policies, Procedures, Protocols and Tools
ISO/IEC 27001:2022 – Vulnerability Management and Patch Deployment
Control ID: Annex A 8.8 – Management of Technical Vulnerabilities
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Browser sandbox escape via logic bugs in Microsoft Edge exposes IT environments to full code execution, threatening zero trust segmentation, east-west traffic integrity, and multicloud control planes without memory corruption indicators.
Financial Services
UXSS primitive bypassing Content Security Policy enables credential harvesting and session hijacking against financial web portals, undermining PCI 4.0 egress controls and NIST.800-53.SC-7 network boundary enforcement.
Government Administration
Logic-flaw sandbox escape exploiting Edge enterprise sign-in features threatens government identity infrastructure, violating ZTMM.Network and NIST.800-53.AC-6 least-privilege mandates with sub-100-line undetectable exploit code.
Health Care / Life Sciences
Arbitrary file write and protocol handler hijacking via browser exploit risks HIPAA-regulated endpoint compromise, circumventing HIPAA.164.312(e)(1) data-in-transit protections and lateral movement controls across clinical workstation environments.
Sources
- Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Winhttps://thehackernews.com/2026/10/researcher-reveals-how-logic-bugs-alone.htmlVerified
- The Last Proof of Human Craft: Browser Full Chain - Orange Tsai DEVCORE Write-Uphttps://blog.orange.tw/posts/2026-10-the-last-proof-of-human-craft-browser-full-chain/Verified
- Microsoft Edge Release Notes for Security Updates - Version 148.0.3967.70https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-securityVerified
- Pwn2Own Berlin 2026 Day One Results - Zero Day Initiativehttps://www.zerodayinitiative.com/blog/2026/5/13/pwn2own-berlin-2026-day-one-resultsVerified
- Microsoft Security Response Center - CVE-2026-45492https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45492Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
This attack exploited browser-layer logic flaws to pivot across web origins, escape the sandbox, and achieve OS-level code execution — all without touching network infrastructure in a traditional sense, yet the post-compromise reach into cloud-connected workloads and outbound data paths is where Aviatrix Zero Trust CNSF would meaningfully constrain attacker impact. By enforcing identity-aware segmentation and controlled egress at the network fabric layer, Aviatrix could likely reduce the blast radius of what the compromised endpoint is permitted to reach or transmit.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The CNSF fabric would likely constrain the network reachability of the compromised endpoint, reducing the number of cloud-hosted resources the attacker's injected script could meaningfully interact with even after UXSS was achieved.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain what the newly escalated browser process context could access in terms of downstream cloud workloads or internal services, reducing the practical scope of privileges gained even after sandbox escape.
Control: East-West Traffic Security
Mitigation: East-west traffic security controls would likely reduce the attacker's ability to move from the compromised endpoint into adjacent cloud workloads or internal services, constraining the network-level reach of any post-compromise activity even if intra-browser pivoting succeeded.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and control would likely surface anomalous outbound traffic patterns from the endpoint, and could constrain the attacker's ability to use standard HTTPS channels for implicit C2 communications across cloud-connected egress paths.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policy enforcement would likely constrain the browser process's ability to transmit harvested session data and credentials to arbitrary external destinations, reducing the attacker's practical ability to exfiltrate sensitive identity material outside of approved egress paths.
Even with OS-level code execution achieved, the attacker's ability to reach cloud-hosted resources, internal services, or other workloads from the compromised endpoint would likely remain constrained by previously established segmentation and egress policies, reducing the broader blast radius of the compromise.
Impact at a Glance
Affected Business Functions
- End-User Web Browsing and Authentication Sessions
- Enterprise Single Sign-On and Conditional Access Workflows
- Web Application Content Security and Cross-Origin Data Integrity
- Windows Host Operating System Process Integrity and Code Execution Controls
Estimated downtime: N/A
Estimated loss: N/A
The exploit chain, if weaponized prior to patching, could have exposed authenticated session tokens, email addresses, and credentials from any website visited in Edge due to the universal cross-site scripting primitive. The misconfigured CORS policy on assets.msn.com allowed any origin to read the victim's Microsoft account email address. Full sandbox escape with arbitrary file write and code execution on the host Windows system would have granted an attacker complete access to all data on the affected machine including stored credentials, documents, and any locally accessible enterprise resources. No confirmed real-world data exposure was reported; this was a controlled Pwn2Own competition demonstration with no evidence of exploitation in the wild.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce egress filtering and FQDN-based policy (Egress Security & Policy Enforcement): Deploy CNSF egress controls to detect and block anomalous outbound HTTPS requests from browser processes to unknown or newly-registered attacker-controlled domains, limiting the attacker's ability to exfiltrate session tokens or identity data harvested via the UXSS primitive.
- • Apply multicloud visibility and anomaly detection (Multicloud Visibility & Control): Instrument network telemetry and traffic observability controls to baseline normal browser egress patterns and alert on repeated or anomalous cross-origin data retrieval attempts, particularly outbound connections from endpoint browser processes that deviate from established baselines.
- • Leverage inline IPS with web exploit signatures (Inline IPS / Suricata): Deploy inline inspection capable of identifying known exploit delivery patterns and malicious payload indicators associated with browser exploitation chains; while logic-only exploits may evade signature detection, IPS rules targeting UXSS delivery patterns, abnormal protocol handler invocations, and suspicious file-write telemetry can reduce dwell time.
- • Implement zero trust segmentation and least-privilege process controls (Zero Trust Segmentation): Apply microsegmentation policies that restrict browser process capabilities at the OS and network layer, limiting which directories are writable by browser processes and which protocol handlers can be invoked, reducing the blast radius of a sandbox escape to contain post-exploitation lateral movement.
- • Deploy cloud firewall with AI-driven traffic discovery (Cloud Firewall / ACF): Use cloud-native firewall capabilities with AI-assisted traffic discovery to identify and block unauthorized outbound connections initiated by compromised endpoint browser sessions reaching cloud-hosted attacker infrastructure, and enforce application-to-internet policies that flag telnet:// or uncommon protocol handler traffic as high-risk indicators requiring immediate investigation.
