Logic Flaws Alone Let Hacker Escape Edge Sandbox
A researcher demonstrated how logic bugs in Microsoft Edge can lead to full system compromise without memory corruption. The exploit earned $175,000 at Pwn2Own and was patched by Microsoft.
TL;DR
- Security researcher Orange Tsai used only logic bugs to break out of Microsoft Edge's sandbox.
- The exploit chain turned a malicious webpage into arbitrary code execution on Windows.
- It won $175,000 at the Pwn2Own Berlin contest in May 2026.
- Microsoft patched the vulnerabilities the day after the contest.
- The full technical details were publicly disclosed in October 2026.
In a striking demonstration of browser security weaknesses, a Taiwanese researcher has revealed how a series of logic bugs—without any memory corruption vulnerabilities—were enough to escape Microsoft Edge's sandbox and execute arbitrary code on a Windows host. The exploit, which netted $175,000 at the Pwn2Own Berlin hacking contest earlier this year, underscores that even well-isolated environments like modern browsers remain vulnerable to subtle logical errors in their design.
Orange Tsai of DEVCORE disclosed the full technical breakdown in late October 2026, five months after the initial win. Microsoft responded quickly by patching the issues the following day after the contest, but the disclosure highlights the persistent challenge developers face in securing complex software systems against creative adversarial thinking.
Exploit Details
- The attack relied entirely on chaining multiple logic flaws within Microsoft Edge.
- No use of memory corruption techniques such as buffer overflows or use-after-free bugs.
- The malicious web page triggered unexpected behavior that escalated privileges beyond the browser sandbox.
- Tsai’s method achieved remote code execution on the underlying Windows operating system.
Impact and Response
- The vulnerability was exploited successfully during Pwn2Own Berlin in May 2026.
- Microsoft issued fixes for the affected Edge components within 24 hours of the contest.
- Public disclosure occurred months later, giving users time to update before full details were known.
- This case reinforces the importance of reviewing application logic, not just memory safety.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.