# Microsoft Edge Logic-Bug Full Chain: UXSS, Immersive Reader File Write and protocols.json Hijack Escape Sandbox to Windows Code Execution (Pwn2Own Berlin 2026)

> Orange Tsai (DEVCORE) chained five Microsoft Edge logic flaws and two Windows/Edge features, with no memory corruption, to reach code execution outside the Edge sandbox on Windows. The chain won $175,000 at Pwn2Own Berlin 2026 and was published in detail on 2026-10-28. No CVE IDs, affected-version ranges or in-the-wild exploitation are stated in the sources.

- **Published:** 2026-11-01T13:20:57Z
- **Last reviewed:** 2026-11-01T13:20:57Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4996
- **ID:** TL-2026-4996
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The chain, demonstrated at Pwn2Own Berlin 2026 (OffensiveCon, 14-16 May 2026) and documented in the researcher's 2026-10-28 write-up, uses fewer than 100 lines of code and relies entirely on logic errors and trusted-feature interactions rather than memory corruption. Pwn2Own results describe it as 4 logic bugs; the write-up and press coverage count five bugs plus two Windows/Edge features (OneAuth automatic sign-in and the AutoLaunchProtocolsComponent protocol-handler configuration).

Stage 1 - universal XSS: Edge's Conditional Access guidance handler (EdgeCAGuidanceNavigationThrottle, reached via a URL of the form https://guidance-ca-error/?email={email}&switch_profile={url}) starts a browser-initiated navigation when the supplied email matches the current profile. The navigation is issued without a source tab (missing source_contents in Chromium's browser_navigator.cc Navigate() call), so it binds to the ACTIVE tab. Attacker-supplied javascript: content therefore executes in whatever site the victim currently has open (UXSS). Because the navigation originates in the browser process, it also bypasses the page's Content Security Policy.

Stage 2 - trust-check and popup bypasses: the throttle only accepted navigations from trusted Microsoft origins (login.live.com) by checking GetLastCommittedURL(), without accounting for a different window controlling the navigation. Navigating a popup opened with window.open passes the check. A hardcoded popup-blocker allowlist entry (about:blank#quickAuthPopup) lets an attacker open the window without user interaction and then reassign its location.

Stage 3 - identity: the OneAuth feature automatically creates and signs in a profile using the existing Microsoft account on Microsoft sites. A CORS misconfiguration on assets.msn.com (embedded in edge://new-tab-page-online; endpoint /service/community/users/me?profile=social&it=edgeid) returns the signed-in user's email to any origin when fetched with credentials. That email is needed to satisfy the Conditional Access handler's profile-match condition.

Stage 4 - privileged-page script execution and file write: the read:// scheme (Immersive Reader) was missing from Edge's JavaScript-URL blocklist, which covered edge://, chrome://, chrome-untrusted:// and devtools://. JavaScript therefore ran on a privileged page with access to chrome.edgeFeedbackPrivate.zipDiagnosticLogFiles(), which accepted path traversal (../) and a NULL byte that stripped the forced .json extension. This gives an arbitrary file write.

Stage 5 - code execution: the write overwrites protocols.json in the AutoLaunchProtocolsComponent directory under the Edge user-data folder, which controls which external protocol handlers launch without a prompt. After edge://restart reloads it, the telnet:// handler is allowed to launch. telnet.exe is not installed by default, so Windows searches PATH, which includes the user-writable %LOCALAPPDATA%\Microsoft\WindowsApps. A planted 32-bit executable there runs outside the Edge sandbox.

The sources do not state CVE IDs, affected Edge versions or patch dates. Per the usual Pwn2Own rule, vendors have 90 days after the event concludes to patch. One source describes the chain as zero-click after the victim loads attacker content. Another notes a separate Edge memory-corruption bug that is not part of this chain. No in-the-wild exploitation has been reported.

## MITRE ATT&CK

- T1203 Exploitation for Client Execution
- T1059.007 JavaScript
- T1185 Browser Session Hijacking
- T1087.003 Email Account
- T1574.007 Path Interception by PATH Environment Variable
- T1574.007 Path Interception by PATH Environment Variable
- T1574.007 Path Interception by PATH Environment Variable

## Sources

- [The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!](https://blog.orange.tw/posts/2026-10-the-last-proof-of-human-craft-browser-full-chain/)
- [Microsoft Edge 0-Click Exploit Chains Five Flaws to Execute Code and Escape Sandbox](https://cybersecuritynews.com/microsoft-edge-zero-click-exploit/)
- [Microsoft Edge Security Flaws Allow Attackers to Execute Code Without Memory Corruption](https://gbhackers.com/microsoft-edge-security-flaws/)
- [Pwn2Own Berlin 2026 - Day One Results (Zero Day Initiative)](https://www.thezdi.com/blog/2026/5/13/pwn2own-berlin-2026-day-one-results)
- [Windows 11 and Microsoft Edge hacked at Pwn2Own Berlin 2026 (BleepingComputer)](https://www.bleepingcomputer.com/news/security/windows-11-and-microsoft-edge-hacked-on-first-day-of-pwn2own-berlin-2026/)
- [Pwn2Own Berlin 2026 (Trend Micro)](https://www.trendmicro.com/ja_jp/research/26/e/pwn2own-berlin-2026.html)
- [Microsoft Edge Pwn2Own 2026: Logic Bug Sandbox Escape Explained (Aviatrix)](https://aviatrix.ai/threat-research-center/researcher-reveals-logic-bugs-cracked-microsoft-edge-175000-pwn2own-win/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4996