A Handful of Modest Microsoft Edge Bugs, One Takeover: Inside the $175,000 Chain That Turned a Web Page Into Code on a Windows PC
Researcher Orange Tsai has published how he chained a handful of logic flaws in Microsoft Edge and Windows into code running outside the browser sandbox, winning $175,000 at Pwn2Own Berlin. Microsoft fixed the Edge bugs in May. Here is how the chain worked and why layered defenses matter when small flaws add up.
Here Is How Layered Defenses Help When Medium-Rated Flaws Get Chained Together
Microsoft rated two of the Edge bugs involved as medium severity when they were scored on their own. Strung together, they let a web page run a program on a Windows computer outside the browser’s protective sandbox. On October 28, Orange Tsai of security firm DEVCORE published the full method behind the Microsoft Edge exploit that earned him $175,000 at Pwn2Own Berlin in May.
The walkthrough below is based on The Hacker News’ breakdown of Tsai’s write-up.
First, the reassurance
- Edge Stable 148.0.3967.70 closed the holes on May 15, one day after the demonstration. A browser that updates automatically received the fix months ago.
- This was a contest demonstration. Nothing suggests anyone has used it against real people, and the CVE entries record no exploitation.
- Microsoft tracked the Edge fixes as CVE-2026-45492, CVE-2026-45494 and CVE-2026-45495. The first two are rated 5.4 out of 10, a score that reflects each bug on its own, not the chain.
How the chain worked, link by link
- A business sign-in feature misfires. Edge has a feature tied to conditional access for business sign-ins. Tsai found that triggering it let the browser start a navigation that was not tied to the page asking for it, so Edge attached it to whatever tab was open. The result: his JavaScript could run inside any site, getting around the content security policy designed to stop exactly that.
- No click required. Four more weaknesses removed the need for user interaction: a trusted-site check he could get around by sending the request from a second window, a hardcoded allow list in the popup blocker that let that window open, Edge’s automatic sign-in on Microsoft sites, and a misconfigured Microsoft web service (assets.msn.com) that handed the user’s email address to any site.
- Out of the sandbox. Edge’s reading mode, Immersive Reader, runs under a special read:// address that was missing from the list of pages that are not allowed to run scripts. Using that foothold, the chain invoked a built-in routine for packaging diagnostic logs and used it to write any file, with any content, anywhere on disk.
- File write becomes code execution. The chain overwrote a configuration file that controls which sites may launch which protocol handlers, then restarted Edge so it would be read. (Tsai notes the restart was a contest convenience, not a requirement.)
- The final step. It then opened a telnet:// link. Windows does not include a telnet program by default, so it searched the system path and found and ran a fake copy the attacker had dropped into a folder that even a limited user account could write to.
By Tsai’s account, the complete exploit is fewer than 100 lines long, and he put it together by hand over about two months. He argues that finding the logic bugs is the hard part, and chaining them is easy once you have them. The research also picked up this year’s Pwnie Award for Epic Achievement.
Which layer breaks which link
No single product would have been the answer here, which is the point. Each layer below would have broken part of the chain or limited the damage:
- Automatic updates: the most important layer. An up-to-date browser closed this chain in May. Confirm updates are actually landing on every device, not just turned on.
- Least privilege: the last step depended on a folder the everyday user could write to sitting in the system search path. Standard user accounts and locked-down write permissions shrink that opportunity.
- Application control: rules that only allow approved programs to run can stop an unexpected executable launched from a user-writable folder, whatever triggered it.
- Browser management: centrally managed browser settings, such as approved protocol handlers and controlled extensions, reduce what a single bug can reach.
- Endpoint detection: a browser spawning an unexpected program is a classic warning sign that monitoring tools can flag and stop.
- Identity protections: since the chain leaned on automatic sign-in, strong multifactor sign-in and session controls limit what any stolen access is worth.
What this means for your company
Severity scores are a starting point, not a to-do list. A string of medium-rated issues can add up to a critical one, so patch browsers and operating systems promptly even when a fix does not sound urgent. Whatever browser and security tools you use, check that updates are enforced, that staff do not work as administrators day to day, and that your endpoint tools would notice a browser launching something it should not.
Want to see how many of these layers are already working on your company’s computers, and which ones are missing? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
