DEVCORE Details Logic-Flaw Chain Behind Edge Pwn2Own Escape
DEVCORE researcher Orange Tsai has published the method behind a Microsoft Edge exploit chain that won $175,000 at Pwn2Own Berlin in May 2026. The chain used logic flaws rather than memory corruption to move from a malicious web page to code execution on Windows outside Edge’s sandbox.
Microsoft fixed the affected issues on May 15, one day after the contest, in Edge Stable version 148.0.3967.70. The release included three Edge-specific fixes: CVE-2026-45492, CVE-2026-45494 and CVE-2026-45495. Systems running a current, automatically updated Edge installation have already received the update.
From browser navigation to universal scripting
Tsai’s chain began with Edge’s conditional access navigation throttle, a business sign-in feature. By triggering it, he could cause the browser process to initiate a navigation that was not tied to the page that requested it. Edge then attached that navigation to whichever tab was open, producing a universal cross-site scripting, or UXSS, primitive.
That capability allowed JavaScript to run on any site and bypass the site’s content security policy. Tsai described several additional weaknesses needed to make the technique operate without a click: a trusted-Microsoft-site check could be bypassed through a second window, an allowlisted address could open a popup, Edge auto-sign-in supplied the required signed-in state, and assets.msn.com exposed an email address through a misconfigured cross-origin setting.
The significance of this chain is reinforced by Edge password exposure and critical zero-days, which examined Edge password exposure in memory alongside other high-impact security issues. In this case, the exploit did not depend on a conventional memory-safety vulnerability, illustrating how ordinary browser and operating-system features can become dangerous when their assumptions do not align.
Turning UXSS into Windows code execution
UXSS alone did not provide control of the computer. To leave the sandbox, Tsai used Edge’s Immersive Reader, which operates under a custom read:// address that Microsoft had not included among pages prohibited from running scripts.
From there, the chain called an internal Edge function intended to archive diagnostic logs. Tsai abused it to write a file with attacker-chosen content and filename to a selected location on disk. The exploit then overwrote a configuration file governing which sites can launch protocol handlers and restarted Edge so that the altered configuration would be loaded.
The final stage launched a telnet:// link. Since Windows does not include a telnet client by default, the system searched its path for a handler and ran an attacker-planted program from a location writable by a low-privileged user. Tsai said the full exploit was under 100 lines of code and that the browser restart was a contest convenience rather than a requirement for a real attack.
What the disclosure means for organisations
The public CVE records list no known exploitation, and Tsai demonstrated the chain at Pwn2Own rather than in attacks against users. Microsoft rates CVE-2026-45492 and CVE-2026-45494 at 5.4 out of 10 in isolation; those scores do not represent the impact of the full chain.
For businesses, the immediate implication is straightforward: confirm that managed devices run Edge 148.0.3967.70 or a later version and retain automatic browser updates. The research also supports reviewing browser findings in combination, because individually moderate logic errors can produce a far more serious outcome when they are chained.