Research by Tsai published October 28, 2026; developed for Pwn2Own Berlin 2026
Five Logic Bugs, No Memory Corruption: A Microsoft Edge Chain Escapes the Sandbox to Run Code
Security research published on October 28 by Tsai describes a Microsoft Edge exploit chain built from five logic bugs and two Windows features, with no memory corruption, developed for Pwn2Own Berlin 2026 over two months of work. The chain starts in EdgeCAGuidanceNavigationThrottle, an Edge component tied to Microsoft Entra Conditional Access that redirects users toward the correct browser profile for supported authentication services: because navigation was initiated without being bound to the originating renderer, attacker JavaScript could execute in a different site context, producing a universal cross-site scripting primitive that bypassed Content Security Policy protections on targeted sites. Supporting weaknesses included a check against the destination window last committed address rather than the cross-window initiator, a hardcoded popup exception, OneAuth automatic authentication, and a cross-origin misconfiguration on assets.msn.com that exposed the signed-in account email address. To leave the browser, the chain used the Immersive Reader read scheme, which was absent from the list of privileged schemes Chromium blocks, reaching an internal feedback interface whose log file function allowed path traversal and null byte handling to write an arbitrary file. Overwriting the protocols.json configuration relaxed restrictions on launching the Windows Telnet handler, and Windows then searched for the missing telnet executable through PATH directories including a user-writable location, converting the file write into code execution outside the sandbox. The disclosure carries an important limit: it does not identify affected Edge versions, corresponding CVE identifiers, or fixed releases, so it documents a demonstrated chain rather than evidence that every current installation remains vulnerable or that the chain is being exploited in the wild.
Executives
Browsers are the most exposed application in any organization, and this chain shows why browser patching and profile hygiene are enterprise controls rather than user preferences. The honest status is that no fixed version is named in the disclosure, so the useful leadership action is to confirm your Edge update channel is current and enforced, and to ask how your team tracks researcher disclosures that arrive without CVE identifiers.
CIO / CISO
Do not file this as a patch ticket with no patch. Record it as an open browser risk item: verify Edge is on the current stable channel across the fleet, keep the browser inside your standard update compliance reporting under the Microsoft Security program, and watch MSRC and the Edge release notes for the corresponding fixes. The Entra Conditional Access component at the start of the chain is also a prompt to review which authentication flows depend on browser profile switching.
Engineers
Note the technique class for detection work: logic flaws across navigation handling, privileged internal schemes, and protocol handler configuration, none of which a memory corruption signature would catch. Keep Edge and WebView2 components updating automatically, including on disconnected or infrequently used machines, and treat unexpected telnet handler launches or writes to browser configuration files as events worth a look.
Everyone (non-IT)
Keep your browser set to update automatically and restart it when it asks. Research chains like this one are published so vendors can close them, and the closing usually arrives as an ordinary browser update you only receive if the browser is allowed to install it.