# Microsoft Edge Logic-Bug Full Exploit Chain Enables Code Execution Without Memory Corruption (Pwn2Own Berlin 2026, Orange Tsai; CVE-2026-45495)

> Orange Tsai (DEVCORE) publicly documented a full Microsoft Edge exploit chain built entirely from browser and OS logic flaws rather than memory corruption, achieving sandbox escape and code execution. It was demonstrated against fully patched Edge on Windows 11 25H2 at Pwn2Own Berlin 2026 and the write-up was published 2026-10-28. Secondary reporting associates the chain with CVE-2026-45495, fixed in Edge 148.0.3967.70.

- **Published:** 2026-11-01T11:35:39Z
- **Last reviewed:** 2026-11-01T11:35:39Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4993
- **ID:** TL-2026-4993
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 5 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-45492, CVE-2026-45494, CVE-2026-45495

## Description

Orange Tsai of DEVCORE Research Team demonstrated this chain against fully patched Microsoft Edge on Windows 11 at Pwn2Own Berlin 2026 (OffensiveCon, Berlin, May 14-16, 2026), earning $175,000 and 17.5 Master of Pwn points toward DEVCORE's first-place finish. On 2026-10-28 he published the full technical write-up, 'The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!', with accompanying slides and a video demonstration. The chain was developed entirely through manual research with no AI assistance and contains no memory-corruption primitive (no ROP, type confusion, or use-after-free) -- every step is a logic flaw in Edge's navigation, origin-checking, or privileged-API handling, or in how Windows resolves protocol handlers.

At a high level, the published chain links: (1) a popup-blocker allowlist entry that lets an attacker-controlled page open a window that is later redirected off the allowlisted origin; (2) a navigation throttle tied to Edge's Entra ID Conditional-Access guidance feature that validates only the last-committed URL and does not check the opener relationship, letting the throttle be reached from an unrelated origin; (3) an overly permissive CORS configuration on an embedded Microsoft asset host that discloses the signed-in user's email to any origin via a credentialed fetch, made usable because Windows 11 25H2's OneAuth/OOBE flow auto-signs Edge profiles into a Microsoft account; (4) a browser-process navigation API that, when invoked without an explicit source tab, defaults to whatever tab the user currently has focused, producing a universal cross-site-scripting (UXSS) primitive attackers use to run script in a victim-chosen context; (5) the read:// Immersive Reader WebUI scheme, which -- unlike other internal schemes -- is not excluded from javascript: URL execution, giving the UXSS a privileged execution context; and (6) the privileged chrome.edgeFeedbackPrivate.zipDiagnosticLogFiles() extension API reachable from that context, whose filename/content handling is vulnerable to path traversal and embedded-NUL extension-stripping, enabling an arbitrary file write outside the intended diagnostics directory. That write is used to overwrite Edge's AutoLaunchProtocolsComponent protocols.json policy file, which governs which origins may launch external protocol handlers; after an edge://restart reload, the attacker's origin is authorized to invoke a handler (telnet://) whose underlying executable is resolved via a Windows PATH search that includes a user-writable directory (WindowsApps), so a planted attacker binary is launched instead of the legitimate one -- yielding arbitrary code execution outside the browser sandbox.

No in-the-wild exploitation of this chain has been reported. Original hunt sourcing (GBHackers, 2026-10-29; Orange Tsai's blog, 2026-10-28) stated no CVE IDs, CVSS scores, or patch details. Subsequent secondary reporting (comss.ru, rapid7, NVD-adjacent trackers, HKCERT bulletin) associates three CVE numbers issued in Microsoft's May 2026 Patch Tuesday Edge/Chromium advisory with this research cycle -- CVE-2026-45492 (full-chain RCE, CVSS 5.4), CVE-2026-45494 (spoofing/auth bypass), and CVE-2026-45495 (elevation of privilege / sandbox escape, reported with conflicting CVSS values across sources: 8.8 per several trackers' summary pages and a 9.8/CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector per Rapid7's detail page) -- with Edge Stable 148.0.3967.70 (Chromium 148.0.7778.168), released 2026-05-15, cited as the fix. These CVE-to-bug mappings come from secondary aggregator sites rather than from Orange Tsai's own write-up or a located Microsoft Security Update Guide page, so attribution of which specific CVE ID corresponds to which individual logic bug in the chain is not confirmed from primary sourcing and should be treated as tentative pending direct MSRC confirmation.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.007 JavaScript
- T1203 Exploitation for Client Execution
- T1204.001 Malicious Link
- T1546 Event Triggered Execution
- T1574.007 Path Interception by PATH Environment Variable
- T1574.007 Path Interception by PATH Environment Variable
- T1539 Steal Web Session Cookie
- T1586 Compromise Accounts
- T1185 Browser Session Hijacking
- T1005 Data from Local System
- T1589.002 Email Addresses
- T1584 Compromise Infrastructure

## Sources

- [Microsoft Edge Security Flaws Allow Attackers to Execute Code Without Memory Corruption](https://gbhackers.com/microsoft-edge-security-flaws/)
- [The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!](https://blog.orange.tw/posts/2026-10-the-last-proof-of-human-craft-browser-full-chain/)
- [Windows 11 and Microsoft Edge Hacked Live at Pwn2Own Berlin](https://hackmag.com/news/pwn2own-berlin-2026)
- [Pwn2Own Berlin wraps up: researchers demonstrate 47 unique 0-days](https://hackmag.com/news/pwn2own-berlin-results)
- [Взлом Edge на Pwn2Own: опубликован разбор цепочки за 175 000 долларов (CVE/patch detail)](https://www.comss.ru/page.php?id=22643)
- [Microsoft Edge (Chromium-based) - CVE-2026-45495](https://www.rapid7.com/db/vulnerabilities/microsoft-edge-cve-2026-45495)
- [Microsoft Edge 多個漏洞 (Security Bulletin)](https://www.hkcert.org/tc/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260518)
- [NVD - CVE-2026-45495](https://nvd.nist.gov/vuln/detail/cve-2026-45495)
- [CVE-2026-45495](https://cveawg.mitre.org/api/cve/CVE-2026-45495)
- [Pwn2Own Berlin 2026, Day One: $523,000 paid out, AI products fall](https://securityaffairs.com/?p=192183)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4993