Orange Tsai's logic-only Edge full chain earns $175,000 at Pwn2Own Berlin
moyix · x · 2026-10-28
DEVCORE researcher Orange Tsai published a writeup of his Microsoft Edge full-chain exploit built for Pwn2Own Berlin 2026 — a completely handmade, logic-only sandbox escape with no memory corruption and no AI involved.
Key facts:
- The chain used 4 logic bugs to escape the sandbox (5 bugs + 2 Windows features overall), earning $175,000 and 17.5 Master of Pwn points, confirmed by ZDI
- It won the Pwnie Awards "Epic Achievement" for 2026; Tsai notes handcrafted exploits feel precious in the AI era
- His entry point was studying Chromium's navigation flow, specifically the often-overlooked Navigation Throttles mechanism
- The full bug-hunting and chaining process was presented at HITCON and Hexacon, with slides available
More from Safety
- 7.25M Gitee Repos Scanned, 26,400 Live Secrets Found Using Modal, TruffleHog and Kingfisher — charles_irl · 2026-10-28
- One balcony photo is enough to pinpoint your exact floor, demo shows — bilawalsidhu · 2026-10-28
- NIST Releases Official Post-Quantum Cryptography Migration Guidance as Harvest-Now-Decrypt-Later Risk Grows — entrup · 2026-10-28
- Gmail's default Gemini integration faces class-action suit over email access — hey_abusiddik · 2026-10-28
- Spooky Cyber Trends for 2026: How AI Is Changing the Threat Landscape — ChuckDBrooks · 2026-10-28
- AI-driven cyber attacks may create huge demand for AI-assisted cyber defense — gleech · 2026-10-28