Browser sandbox escapes usually cost a memory-corruption primitive. Orange Tsai of DEVCORE published one that used none, in fewer than 100 lines of code. The chain won USD 175,000 at Pwn2Own Berlin in May; the write-up landed 28 October.
The entry point is Edge’s conditional access navigation throttle, a business sign-in feature. Triggering it makes the browser process start a navigation with no link to the requesting page, so Edge attaches it to whichever tab is open. That mismatch yields universal cross-site scripting, running JavaScript on sites a page-level bug could not reach.
Five weaknesses, no click
Four more flaws removed the click. Edge validated that a request came from a trusted Microsoft origin, and Tsai opened it from a second window instead. The popup blocker should have stopped that window, except Edge kept a hardcoded allow-list and one entry opened it.
The victim also had to be signed in, which Edge’s auto-sign-in supplies on a Microsoft property. The chain read the user’s email address from assets.msn.com, which returned it to any origin through a misconfigured cross-origin setting.
Escaping the sandbox ran through Immersive Reader, served from a custom read:// scheme Microsoft had left off the script-blocked list. The chain then abused an internal diagnostic-log zipper to write an attacker-chosen file anywhere on disk.
Turning a file write into execution
Tsai overwrote the config governing which sites may launch protocol handlers, restarted Edge, then opened a telnet:// link. Windows ships no telnet client, so the shell searched the path and ran a planted copy from a writable folder.
Microsoft fixed it on 15 May in Edge Stable 148.0.3967.70, with CVE-2026-45492, CVE-2026-45494 and CVE-2026-45495. No exploitation outside the contest is known. Patch level is the whole defence.
