Researcher Details Microsoft Edge Logic Exploit
The $175,000 Pwn2Own-winning exploit chain targeted diagnostic logging, prompting a fix in the latest browser release.
Updated on Oct. 28, 2026 in Cybersecurity
Live Poll
Do you trust that your browser's automatic updates sufficiently protect your computer from new security threats?
Security researcher Orange Tsai has published the methodology for a Microsoft Edge exploit chain that won $175,000 at the Pwn2Own Berlin competition. Microsoft has already patched the vulnerabilities, tracked as CVE-2026-45492, CVE-2026-45494, and CVE-2026-45495, in Edge Stable version 148.0.3967.70.
Why it matters
This research highlights how logic-based flaws in standard enterprise features can bypass security controls without triggering traditional memory corruption defenses. The disclosure provides a blueprint for how attackers might abuse legitimate diagnostic functions to achieve code execution.
The exploit chain uses under 100 lines of code to trigger a file write by abusing an internal diagnostic log function. The fix is implemented in Edge version 148.0.3967.70.
The players
Orange Tsai
An independent security researcher recognized for identifying critical logic-based vulnerabilities in browser and enterprise software ecosystems.
Microsoft
A multinational technology corporation that manages the Edge browser and its associated business-focused authentication and diagnostic infrastructure.
The details
The exploit targets a business sign-in feature known as a conditional access navigation throttle, which manages user authentication flows. By manipulating the logic of how this feature interacts with the Windows operating system, the researcher was able to force the browser to write files to unintended locations. This method bypasses standard memory protection by leveraging the intended, albeit insecure, behavior of internal diagnostic logging rather than attempting to corrupt the application's memory space.
Timeline
May 2026: The exploit chain won the Pwn2Own Berlin contest.
May 15, 2026: Microsoft released security updates for the browser.
October 28, 2026: The full exploit methodology was published by the researcher.
The Tech Race
This disclosure follows the industry standard of validating complex exploits through the Pwn2Own Berlin competition before public release. It marks a shift in focus toward logic-based vulnerabilities as memory-safety improvements make traditional exploits harder to execute.
Users can secure their systems by ensuring they are running Edge version 148.0.3967.70 or newer. There is no evidence that this exploit chain was ever used against real-world systems, meaning manual remediation beyond standard updates is likely unnecessary for most.
The takeaway
The research confirms that logic-based attacks in enterprise navigation tools present a persistent risk even as browser memory protections tighten. Security teams should monitor future Pwn2Own results for similar patterns in how diagnostic logs handle cross-platform signals.
Further reading
For more on how browser security is evolving to combat new exploit classes, see the latest updates in our Cybersecurity section.
Live Poll
Do you trust that your browser's automatic updates sufficiently protect your computer from new security threats?
