Researcher details Edge sandbox escape using logic flaws

Orange Tsai of DEVCORE published the full method for a chain of logic flaws in Microsoft Edge that allowed a malicious web page to break out of Edge’s sandbox and run code on a Windows machine, without any memory corruption. The chain, demonstrated at Pwn2Own Berlin in May 2026 for a $175,000 prize, is described as a universal UXSS primitive that enables JavaScript to run on any website, bypassing the browser’s content security policy.

The exploit allegedly uses fewer than 100 lines of code and starts from Edge’s own processes, meaning it could potentially reach sites such as google[.]com that standard web bugs cannot touch. The research notes this as a new attack surface rather than a single bug.

The chain hinges on multiple linked weaknesses, starting with a business sign-in feature known as the conditional access navigation throttle. Triggering it lets Edge start a new navigation not tied to the requesting page, attaching it to the wrong tab. Additional steps bypass trust checks by spawning a second window from a Microsoft site, exploit a hardcoded allow-list to bypass a popup blocker, and rely on Edge’s auto-sign-in to be active.

The attack also reads the victim’s email address via assets.msn[.]com due to a cross-origin misconfiguration. To escape the sandbox, the chain uses Immersive Reader’s read:// address to execute scripts, then abuses an internal Edge function for zipping diagnostic logs to write a file anywhere on disk. The file-write enables code execution by overwriting a configuration file that controls protocol handlers and restarting Edge, which leads Windows to locate and run an attacker-placed telnet executable.

Microsoft released fixes in Edge Stable version 148.0.3967.70 on 15 May, addressing CVE-2026-45492, CVE-2026-45494, and CVE-2026-45495; Microsoft notes that exploitation was not observed in the wild and the fixes came within 24 hours of disclosure.