Microsoft Edge Hacked With Logic Bugs Only in a $175,000 Pwn2Own Chain

A single web page took over a fully patched Windows computer straight through Microsoft Edge, and the break-in paid 175,000 dollars at a hacking contest. The person who got hit only opened the page. The break-in chained 5 flaws with 2 built-in Windows features and no memory bug at all; the features worked as built, and the holes sat in the checks around them.

The page asked for no download and no file to run, and the browser never crashed. It loaded the way a page loads, and by the time it finished, code chosen by the attacker was running on the machine with the same rights as the person in front of it.

This was done in the open at Pwn2Own Berlin, the contest where researchers attack fully updated software in front of a room and get paid for each break-in that lands. The Edge attack paid 175,000 dollars. The payout drew the headlines, but the method is what made it strange, because the attack ran on logic from the first step to the last, with no memory corruption at any point.

That difference is the heart of it. Almost always, breaking out of a browser has meant finding a memory bug. That is a spot where the program gets pushed into writing data where it does not belong, so an attacker can wedge in their own instructions. Browsers are built with layer on layer to stop exactly that. A logic flaw works another way. Nothing overflows and nothing gets corrupted. Each part does the ordinary thing it was written to do, and the attacker only arranges those ordinary things into an order the designers never planned for. The memory defenses have nothing to catch, because on paper the software behaved.

The holes sat in one place. Edge is built on Chromium, the same engine under Google Chrome, and that engine’s own guardrails mostly held. The weak spots were in what Microsoft bolted on top to make Edge friendlier and more useful for companies: a helper that steers work accounts to the right profile, an automatic sign-in, its own reading mode, its own list of sites allowed to pop up a window. The parts that made Edge convenient were the parts that gave way, one after another.

It starts with being signed in. Since Windows 11 version 25H2, setting up a new computer requires a Microsoft account unless you reach for a workaround, and the simple tricks for skipping it keep getting closed. A feature called OneAuth then signs that account in automatically on Microsoft’s own sites. Opening nothing more than www.microsoft.com is enough for Edge to build a profile and sign the person in, even if they never set one up in the browser. Edge is then signed in to a Microsoft identity as soon as someone opens a Microsoft site.

The first flaw lives in a piece of Edge made for companies. When Edge sees someone signing in to a work account on a Microsoft site, a helper steps in to send them to the right profile. To do that, it takes a web address out of the page and starts a fresh navigation to it, from the browser itself. The researcher noticed that this browser-started navigation did not say which tab it came from, and the engine underneath then falls back to whatever tab is active. That gap turns the helper into a way to run the attacker’s script on any site at all, a hole known as universal cross-site scripting. Because the browser itself launches it, the script even steps over CSP, the rule that normally keeps a page from running code it was never served.

This corner is barely explored. The parts that watch over page navigation account for fewer than 20 of the more than 3,000 flaws that engine has fixed in five years, so few people look there. The fallback that leaks the active tab sits so deep in the shared engine that even its own example code uses it the wrong way, which means the problem is not Edge’s alone. The researcher has said he is close to carrying the same chain over to Chrome itself. What looks like one browser’s mistake points at a seam that other browsers share too.

A hole that needs a click is only half a weapon, so the next job was to fire it with no click at all, and that meant clearing four hurdles. The helper was only supposed to run for a trusted Microsoft site, but its check looked at the wrong window, so the attacker’s page could open a Microsoft login page in a popup and steer that popup from the outside. Popups are blocked by default, except Microsoft kept its own hardcoded list of windows that are always allowed, and borrowing one of those opened the door. The helper needed a signed-in profile, which that automatic sign-in now hands over on its own. And it needed the person’s email address, which a misconfigured setting on Microsoft’s assets.msn.com quietly returned to any page that asked. Four pieces, two of them plain mistakes and two of them built-in conveniences, lined up so the trap springs the moment the page loads.

Running the attacker’s script on a trusted page is still inside the sandbox, the padded room a browser keeps each page locked in so it cannot touch the rest of the computer. That wall is the most important one in a modern browser, and getting past it is what turns a bad web page into a problem for the machine behind it. At this year’s contest in Berlin it was the only browser that fell at all, and the researcher has called browsers the hardest category, because the shared engine’s defenses have been hardened almost to the limit.

The way out ran through Edge’s own reading mode, Immersive Reader, which Microsoft forked from the engine long ago and gave a private address scheme written as read://. The engine keeps a blocklist of its trusted internal pages, the ones not allowed to run a javascript: link, and Microsoft forgot to put read:// on it. From inside that trusted page the script could reach a built-in function meant to zip up diagnostic logs, named zipDiagnosticLogFiles. It had a path flaw and a null-byte trick that together let it write a file anywhere the logged-in user can reach. The first plan was to smuggle in a 64-bit program file and have Edge load it, but the write has to be valid text and a 64-bit program header cannot be formed that way, so that route was a dead end.

The route that did work was a small settings file, protocols.json, that Edge reads to decide which sites may launch which outside programs. Overwriting it let the attacker’s page launch a handler of its own choosing, which is why control of that file was the prize. The attacker pointed it at telnet://. Telnet has not shipped turned on with Windows for years, so Windows went looking for telnet.exe down its list of folders. One folder on that list, the per-user WindowsApps folder, could be written to by the ordinary logged-in user. A tiny 32-bit program dropped there was what Windows found and ran. The exploit came to fewer than 100 lines in total. On the contest stage the browser was restarted to reload the settings file, but the write-up is clear that an attack in the wild would not need even that.

Run back over the chain and look at what each link actually was: a sign-in helper, an automatic login, a reading mode, a diagnostics tool, a list of trusted popups. The features behaved normally, and the flaws sat in the checks wrapped around them. Only one link was not an Edge add-on, the tab-fallback buried in the shared engine. Break any single link and the chain falls over, which is what Microsoft’s three fixes did. The separate pieces stay useful on their own, though, and the researcher calls the browser-process cross-site scripting a fresh attack surface he means to dig into further, so the same ideas could turn up again in a new chain.

Code at the user’s level is already a lot. A program running as the logged-in person can read the documents in that account, reach saved files and browser data, install more software, and start looking for ways to climb higher on the system. The break-in did not need administrator rights to be a serious problem, because the files and data people care about live in the user’s own account anyway. From there, a patient attacker can read the passwords and cookies the browser has saved, copy personal files, watch what gets typed, and wait for a second flaw to lift them to full control of the system.

The timeline shows why none of this was a known weakness. The contest only counts attacks against software that is fully patched and current, so going in, nothing on that stage had a fix waiting. The Edge demo ran on the first day, and Microsoft shipped the repair within a day, on May 15, 2026, in Edge version 148.0.3967.70. The full advisory went public in June, and the chain won an Epic Achievement award at the Pwnie Awards in August. The researcher presented it at HITCON and Hexacon, and on October 28 he put the full write-up on his own blog.

Microsoft split the repair into three tracked fixes and credited the researcher by name. The serious one, CVE-2026-45495, is the remote code execution at the end of the chain, rated 8.8 out of 10, and marked as needing the person to open a page. Two more fixes, both rated 5.4, cover other links in the chain. All three were listed as not public and not seen in the wild before the fix.

The chain was put together by hand, over two months, starting from no experience with modern browser exploitation, by a researcher at the security firm DEVCORE working with the Zero Day Initiative, with no AI anywhere in it. The first flaw sat unused in his notes for weeks, read as a minor redirect, until he saw it was something much larger.

His point in publishing it was plain. With memory bugs the hard part is the exploit, but with logic bugs the hard part is seeing them at all, and once they are seen the chaining is the easy bit. In a year when machines are turning up flaws on their own, a chain this long found entirely by a person shows the hard part is still a human one.

A current copy of Edge is safe from this chain. The method is public because the fix has been out since May, and it has never been used against people.

Checking takes a moment:

• → Open the ⋯ menu in Edge, then Help and feedback, then About Microsoft Edge, or type edge://settings/help
• → Let it update, and confirm the version reads 148.0.3967.70 or newer

None of this is only about Edge. The same shape shows up wherever convenience features pile up on a browser, because each one is a moving part, and moving parts can be lined up. A machine can be taken over without being broken, talked into a chain of reasonable things in an order that no sensible person would choose.

Cross-site scripting, the path tricks that read files they should not, and turning a web request into a running shell are things you can practice safely in a lab of your own.

My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

Orange Tsai, DEVCORE | Microsoft MSRC, CVE-2026-45495 | Zero Day Initiative, Pwn2Own Berlin 2026