Researcher Builds a Microsoft Edge Full Chain Using Only Logic Bugs

Forging a Microsoft Edge Full Chain with Logic Bugs Only

▲ 19austinallegro2 HN discussion
Researcher Builds a Microsoft Edge Full Chain Using Only Logic Bugs

For Pwn2Own Berlin 2026, Orange Tsai assembled a fully handcrafted Microsoft Edge exploit chain with no memory corruption and no AI. It combines five logic bugs and two Windows features: a sourceless navigation UXSS in Edge's Conditional Access throttle, a cross-window origin-check bypass, a hardcoded popup whitelist, OneAuth auto sign-in, and a CORS misconfiguration on assets.msn.com that leaks the signed-in email. The chain won the Pwnie Award for Epic Achievement.

Maybe everyone thinks LLMs can already pwn everything in the AI era, so something made entirely by hand somehow feels a bit more precious.
Read original →HN discussionRSS

More from this day

2026-10-29