Threat reportVulnerabilityTL-2026-4996
Microsoft Edge Logic-Bug Full Chain: UXSS, Immersive Reader File Write and protocols.json Hijack Escape Sandbox to Windows Code Execution (Pwn2Own Berlin 2026)
Microsoft Edge Logic-Bug Full Chain (TL-2026-4996), also tracked as Edge Full Chain with Logic Bugs Only, is a high-severity software vulnerability, first published 2026-11-01. It has no confirmed attribution, affects Microsoft Microsoft Edge (Chromium-based) on Windows, maps to 5 MITRE ATT&CK techniques (T1059.007, T1087.003, T1185), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-4996
- Threat ID
- TL-2026-4996
- Also known as
- Edge Full Chain with Logic Bugs Only, The Last Proof of Human Craft
- Severity
- HIGH
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, finance, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 11
Malware and tooling in Microsoft Edge Logic-Bug Full Chain
Malware and tooling: OneAuth
How Microsoft Edge Logic-Bug Full Chain works
Orange Tsai (DEVCORE) chained five Microsoft Edge logic flaws and two Windows/Edge features, with no memory corruption, to reach code execution outside the Edge sandbox on Windows. The chain won $175,000 at Pwn2Own Berlin 2026 and was published in detail on 2026-10-28. No CVE IDs, affected-version ranges or in-the-wild exploitation are stated in the sources.
The chain, demonstrated at Pwn2Own Berlin 2026 (OffensiveCon, 14-16 May 2026) and documented in the researcher's 2026-10-28 write-up, uses fewer than 100 lines of code and relies entirely on logic errors and trusted-feature interactions rather than memory corruption. Pwn2Own results describe it as 4 logic bugs; the write-up and press coverage count five bugs plus two Windows/Edge features (OneAuth automatic sign-in and the AutoLaunchProtocolsComponent protocol-handler configuration).
Stage 1 - universal XSS: Edge's Conditional Access guidance handler (EdgeCAGuidanceNavigationThrottle, reached via a URL of the form https://guidance-ca-error/?email={email}&switch_profile={url}) starts a browser-initiated navigation when the supplied email matches the current profile. The navigation is issued without a source tab (missing source_contents in Chromium's browser_navigator.cc Navigate() call), so it binds to the ACTIVE tab. Attacker-supplied javascript: content therefore executes in whatever site the victim currently has open (UXSS). Because the navigation originates in the browser process, it also bypasses the page's Content Security Policy.
Stage 2 - trust-check and popup bypasses: the throttle only accepted navigations from trusted Microsoft origins (login.live.com) by checking GetLastCommittedURL(), without accounting for a different window controlling the navigation. Navigating a popup opened with window.open passes the check. A hardcoded popup-blocker allowlist entry (about:blank#quickAuthPopup) lets an attacker open the window without user interaction and then reassign its location.
Stage 3 - identity: the OneAuth feature automatically creates and signs in a profile using the existing Microsoft account on Microsoft sites. A CORS misconfiguration on assets.msn.com (embedded in edge://new-tab-page-online; endpoint /service/community/users/me?profile=social&it=edgeid) returns the signed-in user's email to any origin when fetched with credentials. That email is needed to satisfy the Conditional Access handler's profile-match condition.
Stage 4 - privileged-page script execution and file write: the read:// scheme (Immersive Reader) was missing from Edge's JavaScript-URL blocklist, which covered edge://, chrome://, chrome-untrusted:// and devtools://. JavaScript therefore ran on a privileged page with access to chrome.edgeFeedbackPrivate.zipDiagnosticLogFiles(), which accepted path traversal (../) and a NULL byte that stripped the forced .json extension. This gives an arbitrary file write.
Stage 5 - code execution: the write overwrites protocols.json in the AutoLaunchProtocolsComponent directory under the Edge user-data folder, which controls which external protocol handlers launch without a prompt. After edge://restart reloads it, the telnet:// handler is allowed to launch. telnet.exe is not installed by default, so Windows searches PATH, which includes the user-writable %LOCALAPPDATA%\Microsoft\WindowsApps. A planted 32-bit executable there runs outside the Edge sandbox.
The sources do not state CVE IDs, affected Edge versions or patch dates. Per the usual Pwn2Own rule, vendors have 90 days after the event concludes to patch. One source describes the chain as zero-click after the victim loads attacker content. Another notes a separate Edge memory-corruption bug that is not part of this chain. No in-the-wild exploitation has been reported.
MITRE ATT&CK techniques used in TL-2026-4996
Execution
T1059.007 JavaScript; T1203 Exploitation for Client Execution
Discovery
Collection
T1185 Browser Session Hijacking
stealth
T1574.007 Path Interception by PATH Environment Variable
Defense Evasion
Affected products and versions in Microsoft Edge Logic-Bug Full Chain
- Microsoft — Microsoft Edge (Chromium-based) on Windows
Remediation for Microsoft Edge Logic-Bug Full Chain
Patches
- Apply current Microsoft Edge (Chromium-based) updates; specific fixed builds are not stated in the sources
Immediate actions
- Update Microsoft Edge to the latest stable release; the sources give no patch or version details, so confirm fixes against the Microsoft Security Update Guide and Edge release notes
- Hunt for writes to AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\*\protocols.json by processes other than Edge updater/component services
- Hunt for executables created in %LOCALAPPDATA%\Microsoft\WindowsApps by non-Store processes, and for telnet.exe launches from user-writable paths
Workarounds
- Where telnet is not needed, deny execution of unsigned binaries from WindowsApps and user-profile PATH directories
- Limit automatic work-account profile sign-in (OneAuth) on unmanaged browsing profiles where feasible
Longer-term hardening
- Treat user-writable directories on PATH as an execution risk and monitor or restrict them with AppLocker/WDAC
- Restrict external protocol handlers (AutoLaunchProtocolsAllowedForOrigins and related Edge policies) where not required
- Review browser features for interactions between navigation, identity (OneAuth/Conditional Access) and privileged pages, not each feature in isolation
Weaknesses (CWE) in Microsoft Edge Logic-Bug Full Chain
Timeline of Microsoft Edge Logic-Bug Full Chain
- Orange Tsai of DEVCORE demonstrates a Microsoft Edge sandbox escape on Day One of Pwn2Own Berlin 2026 at OffensiveCon, earning $175,000 and 17.5 Master of Pwn points. The result is announced as a chain of 4 logic bugs.
- Day 2 (per Trend Micro): Orange Tsai chains 3 bugs for SYSTEM RCE on Microsoft Exchange for $200,000, a separate target from the Edge chain. The 2026-05-15 date is inferred from the event schedule.
- Pwn2Own Berlin 2026 concludes; DEVCORE wins Master of Pwn. Under standard Pwn2Own rules vendors have 90 days from this point to patch disclosed bugs.
- Computed end of the standard 90-day Pwn2Own vendor patch window (2026-05-16 plus 90 days). The sources do not confirm patch dates or CVE assignment.
- Orange Tsai publishes the full technical write-up 'The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!', detailing five bugs and two Windows/Edge features, with no memory corruption and under 100 lines of code.
- Cyber Security News reports the chain as an Edge 0-click exploit combining five flaws; no CVEs, affected versions or in-the-wild exploitation are stated.
Sources cited for Microsoft Edge Logic-Bug Full Chain
- The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!
- Microsoft Edge 0-Click Exploit Chains Five Flaws to Execute Code and Escape Sandbox
- Microsoft Edge Security Flaws Allow Attackers to Execute Code Without Memory Corruption
- Pwn2Own Berlin 2026 - Day One Results (Zero Day Initiative)
- Windows 11 and Microsoft Edge hacked at Pwn2Own Berlin 2026 (BleepingComputer)
- Pwn2Own Berlin 2026 (Trend Micro)
- Microsoft Edge Pwn2Own 2026: Logic Bug Sandbox Escape Explained (Aviatrix)
Detection coverage for TL-2026-4996
As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4996 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.