Microsoft Edge full chain exploit via logic bugs
The gist
DEVCORE researcher Orange Tsai chained logic bugs to escape Microsoft Edge's sandbox, winning $175,000 at Pwn2Own Berlin.
The full method is now public, and Microsoft fixed the flaws the next day.
How it unfolded
- May 14, 2026Orange Tsai of DEVCORE chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points at Pwn2Own Berlin.
- May 15, 2026Microsoft shipped fixes the day after the demonstration in Edge Stable 148.0.3967.70; browsers on automatic updates already carry them.
- Oct 28, 2026Tsai published the full method, stating the whole chain is made up of five bugs and two Windows features, researched over two full months with no LLMs or AI.