Orange Tsai Demonstrates 100% Logic-Only Full Chain Sandbox Escape in Microsoft Edge

The Three-Question Framework

What Happened?

On October 29, 2026, DEVCORE head of research Orange Tsai published the comprehensive technical breakdown of his Pwn2Own Berlin 2026 winning exploit against Microsoft Edge. The exploit chain achieved a complete browser sandbox escape and arbitrary code execution strictly through five software logic flaws and two native Windows features, entirely dispensing with memory corruption, return-oriented programming (ROP), or heap spraying. The demonstration earned $175,000, 17.5 Master of Pwn points, and the 2026 Pwnie Epic Achievement award.

Why It Matters

Modern browser security relies heavily on memory safety mitigations, including Miracl, MiraclePtr, Control Flow Guard, and sandboxed renderer isolation. By bypassing the sandbox entirely through semantic flaws in Chromium navigation throttles and Windows protocol handlers, Tsai proved that hardening against memory bugs does not defend against architectural logic inconsistencies. In an era where automated LLM-based fuzzing targets memory vulnerabilities, handmade logic analysis uncovered flaws that automated pipelines systematically overlooked.

What Could Happen Next

Microsoft and the Chromium team have rolled out comprehensive patches for the underlying vulnerabilities, including redesigning navigation binding in EdgeCAGuidanceNavigationThrottle and tightening Entra ID profile-switching checks. Security architects are now revisiting privileged browser throttles and IPC handlers to ensure navigation contexts strictly bind to calling renderer frames, eliminating sourceless navigation primitives across Chromium derivatives.

Executive Key Takeaways

Orange Tsai details 100% logic-based Microsoft Edge full chain earning $175K at Pwn2Own Berlin 2026.

Chain combines five pure logic flaws and two Windows operating system features with zero memory corruption.

Discovers 'Sourceless Navigation' UXSS primitive in EdgeCAGuidanceNavigationThrottle due to unbound active tab context.

Source: Technical research disclosure published October 29, 2026, by Orange Tsai, titled 'The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!'.

The foundation of the attack chain rests on an overlooked corner of Chromium architecture known as Navigation Throttles. While examining Microsoft Edge's enterprise Entra ID integration, Tsai identified EdgeCAGuidanceNavigationThrottle, a specialized component designed to steer users to designated enterprise profiles when accessing corporate Microsoft web properties such as login.live.com via crafted guidance URLs.

Crucially, when the throttle intercepted an authorized profile switch, it canceled the renderer's initial request and triggered an internal browser-level navigation using NavigateParams. However, Edge engineers omitted the explicit source_contents binding. Chromium's fallback logic automatically assigned the browser's currently focused active tab as the renderer source. By initiating the navigation with an asynchronous delay and enticing the user to switch tabs, Tsai turned a restricted redirection into a Universal Cross-Site Scripting (UXSS) primitive on arbitrary target origins.

From the privileged UXSS foothold, Tsai systematically chained four additional logic inconsistencies across Edge's internal browser settings, privileged JavaScript schemes, and native Windows shell registration handlers. Rather than wrestling with hardware-enforced control flow integrity or memory sandboxes, each step leveraged legitimate operating system semantics to achieve arbitrary local payload execution in the user context.

The Three-Question Framework

What Happened?

Why It Matters

What Could Happen Next

Executive Key Takeaways

Primary Sources & Citations