high

Orange Tsai publishes logic-bug-only Edge sandbox escape chain from Pwn2Own Berlin 2026; fixed in Edge 148.0.3967.70

2 fonte(s) · 2 atualização(ões) · publicado 28/10/2026 13:23 · coletado há 3 dias

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 30/10/2026 00:03; os links antigos trazem para cá.

Fontes: gbhackers.com ↗ thehackernews.com ↗

Orange Tsai of DEVCORE published on October 28 the full technique behind his $175,000 Pwn2Own Berlin win in May 2026 (thehackernews.com, gbhackers.com). The chain takes an ordinary web page to code execution outside the Microsoft Edge sandbox on Windows using only logic flaws and no memory corruption, in under 100 lines of code, with no clicks needed beyond visiting the page. It combines five bugs and two Windows features. Microsoft fixed the bugs on May 15, the day after the contest, in Edge Stable 148.0.3967.70 (thehackernews.com). This was a competition exploit: there is no evidence of in-the-wild use, and the public CVE records list exploitation as none (thehackernews.com). The research later won the 2026 Pwnie Award for Epic Achievement (both sources).

Entenda a falha

A vulnerabilidade

This is a chain of five logic bugs plus two Windows features in Microsoft Edge (Chromium-based) that escapes the browser sandbox and runs code on Windows, demonstrated on Windows 11 25H2. The victim only has to visit the attacker's page, with no clicks. Microsoft fixed it in Edge Stable 148.0.3967.70; versions before that are affected. The fixes are tracked as CVE-2026-45492 (security feature bypass), CVE-2026-45494 (spoofing) and CVE-2026-45495. The first two are rated 5.4 (medium) in isolation, which understates the full chain. The bugs are a UXSS in EdgeCAGuidanceNavigationThrottle, an origin check bypass, a popup blocker bypass, a CORS misconfiguration on assets.msn.com that leaks the user's email, and a missing read:// entry in the JavaScript URL blocklist. They lead to an arbitrary file write through edgeFeedbackPrivate.zipDiagnosticLogFiles().

Como funciona

A victim opens the attacker's page. The page reads the signed-in user's email through the assets.msn.com CORS flaw. Edge can already have a signed-in profile, because Windows 11 25H2 setup requires a Microsoft account and OneAuth signs the user in. The page opens a popup through a hardcoded popup-blocker allowlist entry and navigates it so that EdgeCAGuidanceNavigationThrottle sees a matching email. The throttle then starts a browser-initiated navigation to a URL from the query string. That navigation has no source tab, so Chromium runs it in the active tab, giving UXSS that ignores CSP. The script runs on the privileged Immersive Reader page and calls a native feedback function that writes a file. The file overwrites protocols.json, Edge restarts (a contest convenience, not needed in a real attack), and a telnet:// link makes Windows find a planted telnet.exe.

Por que é vulnerável

There is no single root cause: each step is a missing check or a wrong assumption. The throttle verifies only the last committed URL, so a popup passes. It also launches a navigation with no source tab, so Chromium falls back to the active tab. The popup blocker has a hardcoded allowlist entry that an attacker can redirect. The assets.msn.com CORS policy returns the user's email to any origin. The read:// scheme was left out of the blocklist that stops JavaScript URLs on privileged pages. zipDiagnosticLogFiles() accepts path traversal, and a null byte removes the forced .json extension. Windows searches the PATH for telnet.exe and finds a planted copy in the user-writable WindowsApps folder. The articles do not describe the code changes in the fix beyond the version that shipped it.

Onde está

The articles name EdgeCAGuidanceNavigationThrottle, the native function edgeFeedbackPrivate.zipDiagnosticLogFiles(), the about:blank#quickAuthPopup allowlist entry, the read:// scheme blocklist, the assets.msn.com CORS policy and the protocols.json file; no public commit is cited.

Como foi descoberta

Orange Tsai of DEVCORE found and chained the bugs for Pwn2Own Berlin in May 2026, building the chain by hand over about two months without AI help. He demonstrated it on the opening day, earning $175,000 and 17.5 Master of Pwn points. Microsoft shipped the fix on May 15, the day after the contest, in Edge 148.0.3967.70, and DEVCORE said it came within 24 hours of disclosure. Tsai published the full write-up on October 28, five months later. The research later won the 2026 Pwnie Award for Epic Achievement. gbhackers.com says the chain builds on earlier Edge vulnerabilities he reported at Pwn2Own. There is no evidence of in-the-wild exploitation.

PoC pública

Orange Tsai published the full exploit chain and write-up on his personal blog, according to gbhackers.com; the blog address is not in the input, so poc_url points to the article that reports it. It shows a working sandbox escape from an ordinary web page with no clicks, using only logic bugs, in under 100 lines of code. It was demonstrated live at Pwn2Own Berlin, so it is a working exploit, not just a crash or check. Since the fix shipped in May in Edge 148.0.3967.70, up-to-date browsers are protected; the risk is mainly unpatched Edge, now that the technique is public.

Publicada em: gbhackers.com/microsoft-edge-security-flaws/ ↗

Explicação gerada por IA a partir da matéria e dos artigos, em 30/10/2026 00:18.

Detalhes técnicos

UXSS primitive: Edge's conditional access navigation throttle (EdgeCAGuidanceNavigationThrottle), a business sign-in feature, launches a browser-initiated navigation to a URL from the query string when the email matches the current profile. The navigation has no source tab, so Chromium attaches it to the active tab. The result is universal XSS (UXSS) that bypasses CSP and can reach sites such as google.com (both sources).
Origin check bypass: the throttle checks only the last committed URL, so a popup opened with window.open from a second window passes the trusted-Microsoft-site check (gbhackers.com, thehackernews.com).
Popup blocker bypass: a hardcoded allowlist entry, about:blank#quickAuthPopup, lets the attacker open a window and redirect it (gbhackers.com, thehackernews.com).
Automatic sign-in: the OneAuth feature and Edge auto-sign-in supply the signed-in state. Windows 11 25H2 setup requires a Microsoft account, so Edge can create a signed-in profile on its own (gbhackers.com).
Email leak: a CORS misconfiguration on assets.msn.com returns the signed-in user's email address to any website (both sources).
Privileged page: Chromium blocks JavaScript URLs on pages such as edge://, but the Immersive Reader read:// scheme was missing from the blocklist, so the UXSS runs on a privileged page and escapes the sandbox (both sources).
Arbitrary file write: the internal function edgeFeedbackPrivate.zipDiagnosticLogFiles(), meant to zip diagnostic logs, accepted path traversal, and a null byte removed the forced .json extension, giving a write of attacker-chosen name and content anywhere on disk (gbhackers.com, thehackernews.com).
Code execution: Tsai overwrote protocols.json, which controls which origins may launch protocol handlers, then restarted Edge via edge://restart so the file is read (a contest convenience, not needed in a real attack, per thehackernews.com). A telnet:// link makes Windows, which has no default telnet program, search the PATH for telnet.exe, and it ran a planted 32-bit executable from the user-writable WindowsApps folder (gbhackers.com).
CVEs: the fixes shipped as CVE-2026-45492 (security feature bypass), CVE-2026-45494 (spoofing) and CVE-2026-45495. The first two are rated 5.4 (medium) in isolation, which does not reflect the full chain (thehackernews.com). DEVCORE said the fix came within 24 hours of disclosure (thehackernews.com).
Tsai built the chain by hand over about two months without AI help (thehackernews.com).

Remediação

Update Edge to version 148.0.3967.70 or later. Browsers on automatic updates have long since received the fix and need no separate action (thehackernews.com).

Relatos divergentes

Patch status: gbhackers.com (published October 29) says it could not confirm patch details for this chain and tells defenders to check Microsoft advisories. thehackernews.com (published October 28) gives the fixed version (148.0.3967.70), the fix date (May 15) and the CVE IDs. The more specific thehackernews.com account is the better supported; gbhackers.com's statement reflects a gap in its reporting rather than evidence that the chain is unpatched.

Linha do tempo

gbhackers.com ↗ · pub. 29/10/2026 07:37 · coletado 29/10 08:00

Orange Tsai publishes logic-bug-only Microsoft Edge sandbox escape chain from Pwn2Own Berlin 2026, with no memory corruption
ler a análise desta fonte ocultar
Orange Tsai of DEVCORE published a full exploit chain for Microsoft Edge that escapes the browser sandbox and executes code on Windows using only logic vulnerabilities, with no memory corruption. He built it for Pwn2Own Berlin 2026, where it earned $175,000, and it later won the Epic Achievement award at the Pwnie Awards. The chain combines five bugs and two Windows features in under 100 lines of code. It runs from an ordinary web page with no clicks once the victim visits it. The article could not confirm patch details for this chain, so defenders should check Microsoft advisories.

Technical Details
- UXSS primitive: EdgeCAGuidanceNavigationThrottle launches a browser-initiated navigation to a URL from the query string when the email matches the current profile. The navigation has no source tab, so Chromium uses the active tab. This yields universal XSS that ignores CSP.
- Origin check bypass: the throttle checks only the last committed URL, so a popup opened with window.open passes.
- Popup blocker bypass: a hardcoded allowlist entry, about:blank#quickAuthPopup, opens a window the attacker can redirect.
- Automatic sign-in: the OneAuth feature signs users in on Microsoft sites. Windows 11 25H2 setup requires a Microsoft account, so Edge can create a signed-in profile on its own.
- Email leak: a CORS misconfiguration on assets.msn.com returns the signed-in user's email to any website.
- Privileged page: Chromium blocks JavaScript URLs on pages such as edge://, but the Immersive Reader read:// scheme was missing from the blocklist, so the UXSS runs on a privileged page.
- Arbitrary file write: edgeFeedbackPrivate.zipDiagnosticLogFiles() accepted path traversal, and a null byte removed the forced .json extension.
- Code execution: Tsai overwrote protocols.json, which controls which origins may launch protocol handlers, then restarted Edge via edge://restart. A telnet:// link made Windows search the PATH for telnet.exe, which ran a planted 32-bit executable from the user-writable WindowsApps folder.
Remediation

The article could not confirm patch details for this specific chain. Check Microsoft security advisories for the exact fixes and keep Edge fully updated.
thehackernews.com ↗ · pub. 28/10/2026 13:23 · coletado 28/10 15:00 primeiro registro

Orange Tsai publishes logic-bug-only Microsoft Edge sandbox escape chain that won $175,000 at Pwn2Own Berlin; fixed May 15
ler a análise desta fonte ocultar
Orange Tsai of DEVCORE published on October 28 the full technique behind his $175,000 Pwn2Own Berlin win in May. The chain takes a malicious web page to code execution outside the Microsoft Edge sandbox using only logic flaws and no memory corruption, in under 100 lines of code. Microsoft fixed the bugs on May 15, the day after the contest, in Edge Stable 148.0.3967.70. This was a competition exploit, there is no evidence of in-the-wild use, and the public CVE records list exploitation as none.

Technical Details
- The chain starts with Edge's conditional access navigation throttle, a business sign-in feature. Triggering it makes the browser process start a navigation not tied to the requesting page, so Edge attaches it to whichever tab is open. This yields a universal XSS (UXSS) primitive that bypasses CSP and can reach sites such as google.com.
- Four more weaknesses make it run without a click. The trusted-Microsoft-site check was bypassed by opening the request from a second window. A hardcoded popup-blocker allowlist let that window open. Edge auto-sign-in supplied the signed-in state. A misconfigured cross-origin setting on assets.msn.com leaked the victim's email address to any website.
- The sandbox escape abuses Edge's Immersive Reader reading mode, which runs under a custom read:// address that Microsoft left off the list of pages barred from running scripts.
- From there, an internal Edge function meant to zip diagnostic logs is abused to write a file with attacker-chosen name and content anywhere on disk.
- The file write becomes code execution in two steps. The chain overwrites the configuration file controlling which sites may launch which protocol handlers, then restarts Edge so the file is read (a convenience for the contest, not needed in a real attack). It then launches a telnet:// link; Windows has no default telnet program, so it searches the system path and runs an attacker-planted copy from a folder the low-privileged user can write to.
- Fixes shipped in Edge 148.0.3967.70 as CVE-2026-45492 (security feature bypass), CVE-2026-45494 (spoofing) and CVE-2026-45495. The first two are rated 5.4 (medium) in isolation, which does not reflect the full chain. DEVCORE said the fix came within 24 hours of disclosure.
- Tsai built the chain by hand over about two months without AI help. The research won the 2026 Pwnie Award for Epic Achievement.
Remediation

Update Edge to version 148.0.3967.70 or later. Browsers on automatic updates have long since received the fix and need no separate action.