Orange Tsai's logic-only Edge full chain wins $175k at Pwn2Own, no memory corruption
mboehme_ · x · 2026-11-02
Security researcher mboehme cites Orange Tsai's deep-dive: what counts as a security issue is highly domain- and even program-specific, and automatically inferring these "error specifications" will be the next frontier in security — pointing to Orange Tsai chaining domain-specific logic bugs to pop calc from MS Edge.
From the original article:
- Orange Tsai (DEVCORE) built a fully handmade, logic-only Microsoft Edge full chain at Pwn2Own Berlin 2026 — no memory corruption, no AI — earning $175,000, 17.5 Master of Pwn points, and a Pwnie Award for Epic Achievement
- The chain combines 5 bugs and 2 Windows features to achieve sandbox escape, starting from the rarely-examined Navigation Throttles in Chromium's navigation flow
- He shared the full bug-hunting and chaining process at HITCON and Hexacon; the article is a detailed methodology writeup
- His quip: in an era when everyone assumes LLMs can pwn everything, a purely handcrafted chain feels precious
Related event: Researcher: Auto-inferring error specifications is security's next frontier(4 posts)→
More from AGI Musings
- AI researcher: we have no reliable way to tell whether an AI system is conscious — dioscuri · 2026-11-02
- Forward Deployed Verifier will soon be as valuable as FDE, argues poster — vaibhavbetter · 2026-11-02
- Automation took over my daily work — so why am I still sitting in the office for 8 hours? — Am1rSori · 2026-11-02
- 'AI is a massive balance patch and elo reset in the game of life—and everyone's still playing the old meta' — zack_overflow · 2026-11-02
- Why AI isn't 'alien intelligence': a tree is stranger than any model — LucaAmb · 2026-11-02
- Mathematician Tony Feng: current-paradigm LLMs lack the diversity of thought research needs — littmath · 2026-11-02