Forging a Microsoft Edge Full Chain with Logic Bugs Only

A manually developed Microsoft Edge exploit chain for Pwn2Own Berlin 2026 combines logic flaws rather than memory corruption to escape the browser sandbox. The researcher reports chaining four logic bugs, as part of a chain involving five bugs and two Windows features, to win $175,000 and 17.5 Master of Pwn points; the work also received a Pwnie Award for Epic Achievement. The investigation focused on Edge’s little-studied navigation throttles, which can cancel a navigation and launch a replacement URL through browser-side code. Edge’s Conditional Access throttle accepts a URL from a query parameter after checking the signed-in profile’s email. Because its origin validation relies on the last committed URL in one WebContents, a navigation from another window can evade the check. The browser then uses the active tab as the navigation source when none is specified, creating a universal cross-site scripting primitive.

Making the exploit reliable requires overcoming several conditions. Edge’s popup blocker can be bypassed by opening a whitelisted about:blank URL and then redirecting the popup. The throttle also requires a signed-in profile and its matching email; the account requirement can be met because Edge’s OneAuth feature signs users into Microsoft sites, and Windows 11 version 25H2 setup typically requires a Microsoft account. To obtain the email without prior knowledge, the researcher found that assets.msn.com exposes the signed-in user’s address and has a CORS misconfiguration, allowing credentialed requests from another site to read it. These findings show how overlooked browser workflow assumptions and account integrations can combine into a serious security boundary failure.