At Pwn2Own Berlin 2026, Orange Tsai of DEVCORE Research Team demonstrated a completely handmade, logic-only Microsoft Edge Full Chain with no memory corruption or AI assistance. The chain chained four logic bugs to achieve a sandbox escape, earning $175,000 and 17.5 Master of Pwn points. The exploit leveraged Edge’s Enterprise Entra ID feature, specifically the Edge CAGuidance Navigation Throttle, to manipulate navigation requests.
By triggering a throttle from a Microsoft-owned origin like login.live.com, the attacker could redirect navigation to internal or pseudo-schemes such as edge://settings or javascript:alert(origin). The chain involved five bugs and two Windows features, and was presented at HITCON and Hexacon. It won the Epic Achievement award at the Pwnie Awards and was nominated for its innovative approach in the AI era.
Source: Hacker News · Summarized by HeadlinesBriefing