Logic Bugs Alone Broke Out of Microsoft Edge's Sandbox at Pwn2Own Berlin
Browsers on automatic updates already carry Microsoft's fix, and the research shows a new route for cross-site scripting that reaches major sites.
A security researcher at DEVCORE, Orange Tsai, published on October 28 a full method for chaining logic flaws, with no memory corruption, into code execution outside Microsoft Edge's sandbox on Windows. The exploit earned $175,000 at the Pwn2Own Berlin contest in May and was demonstrated on stage rather than seen in the wild. Microsoft patched the bugs in Edge Stable 148.0.3967.70 on May 15, the day after the contest, so browsers on automatic updates already carry the fix. The chain produces a universal cross-site scripting primitive that can reach sites such as google.com, a result Tsai presents as a new attack surface. The work was done by hand over roughly two months and won the 2026 Pwnie Award for Epic Achievement.
Why it matters
The work shows that flaws in program logic, without any memory corruption, can be chained into code execution outside a browser sandbox. For users, the practical gap is closed on automatic updates, since Microsoft shipped the fix in Edge Stable 148.0.3967.70 on May 15. For web security more broadly, the result points to a class of bugs that memory-safety defenses do not address, and the universal cross-site scripting primitive it produces can reach sites such as google.com. Tsai presents this as a new attack surface, so the lesson is that sandbox design must account for logic errors as well as memory bugs.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.