Logic Flaws Alone Broke Out of Microsoft Edge's Sandbox in $175,000 Pwn2Own Win

Orange Tsai of DEVCORE has published the full method behind an exploit that won $175,000 at the Pwn2Own Berlin contest in May. The chain used only logic errors in how Edge and Windows handle ordinary features, and no memory corruption. Tsai says the whole exploit is under 100 lines of code. It can turn a malicious web page into code running on a Windows computer outside the browser's sandbox, the barrier that keeps web content away from the rest of the machine.

The chain starts with an Edge feature for business sign-ins, called a conditional access navigation throttle. Triggering it makes the browser's own process start a navigation not tied to the page that requested it, so Edge attaches it to whichever tab is open. That first bug produces a universal cross-site scripting (UXSS) primitive, which runs JavaScript on any website and bypasses content security policy. Four more weaknesses let it run without a click. These included a trusted-site check bypassed by opening the request from a second window, and a popup blocker that allowed one address on a hardcoded list.

This was a competition exploit, not an attack seen in the wild. There is no evidence it has been used against real users, and the public CVE records list exploitation as none. Microsoft fixed the Edge bugs the day after the contest, so an up-to-date browser is not at risk. Tsai describes the technique as a new attack surface rather than a one-off bug.