Logic Flaw Chain Achieves Edge Sandbox Escape at Pwn2Own Without Memory Corruption

The exploit began with a navigation throttle mismatch that produced universal XSS from the browser process itself. Subsequent flaws bypassed origin checks via window handling and auto-sign-in, read email data from misconfigured MSN endpoints, then abused read:// in Immersive Reader to write attacker-controlled files. The final step overwrote protocol handler configuration and planted a telnet binary in a user-writable path. Microsoft patched the three Edge CVEs the day after the May contest in build 148.0.3967.70, rating isolated bugs medium severity.

Public records and Tsai's DEVCORE write-up confirm no in-the-wild exploitation. The chain required the victim already signed into Microsoft services, a condition Edge auto-sign-in readily satisfies. This matches patterns seen in prior Pwn2Own entries where logic errors replaced memory corruption once mitigations like CFI and sandboxing tightened. Official Microsoft advisories list only the individual CVEs without acknowledging the full chain's impact.

Independent analysis of procurement and vulnerability data shows browser vendors have shifted resources toward memory safety while logic surfaces around enterprise features remain under-audited. The 2026 Berlin results indicate this surface is now competitive for high-value escapes.

Future contests will likely surface similar chains targeting remaining enterprise integration points. Vendors must expand policy enforcement testing to cover conditional navigation and reader-mode origins within the next release cycle.