Logic Bug Chain Bypasses Microsoft Edge Sandbox, Researcher Details Exploit Method

On October 28, 2026, Orange Tsai of DEVCORE published the full method for a sandbox escape chain that won $175,000 at the Pwn2Own Berlin contest in May 2026. The exploit consists of a sequence of logic flaws in Microsoft Edge that, when chained together, allow a malicious web page to execute code outside the browser's sandbox on the Windows operating system. Notably, the chain requires no memory corruption vulnerabilities; it relies entirely on logical errors in how Edge handles web content. Microsoft confirmed that it fixed the reported bugs the day after the Pwn2Own Berlin contest concluded in May 2026. The publication provides technical details of the chain, though the exact number and specific interaction of the logic flaws are not itemized in the public summary. The research underscores the potential risk posed by logic bugs in browser architecture, even in the absence of traditional memory safety issues.