Orange Tsai of DEVCORE published a technical account of a Microsoft Edge logic-bug chain on October 28, 2026. He had demonstrated it at Pwn2Own Berlin on May 14, where the contest announcement reported a $175,000 award and 17.5 Master of Pwn points. Microsoft’s release notes had listed fixes for the associated Edge vulnerabilities on May 15.
How a tab mix-up led to UXSS
Tsai says the chain began with Edge’s Conditional Access navigation throttle. A navigation initiated by the browser process lacked a binding to the page that started it, so Chromium used the active tab as the source. In the described scenario, that could make JavaScript run with another site’s origin. This is universal cross-site scripting, or UXSS: script runs with the privileges associated with a different site.
The later stages combined cross-window navigation and Edge behavior with a signed-in profile. Tsai says a CORS misconfiguration involving assets.msn.com exposed the account email in his scenario. The chain then used Immersive Reader’s read:// scheme and an Edge diagnostic-log function on the way to changing Edge’s protocol configuration. Windows protocol handling then provided a route to code execution outside the browser sandbox.
The Calculator-to-Edge clip shows a separate follow-up
A second screen recording runs in the opposite direction: Calculator opens first, then Microsoft Edge launches to the HITCON 2026 site. Tsai described this as a separate Windows exploit that could open Edge from calc.exe, not the main chain that went from Edge to code execution outside its sandbox.
Microsoft’s May 2026 Edge release entry
Microsoft’s May 15, 2026 security release notes list Edge Stable version 148.0.3967.70 with fixes for CVE-2026-45492, CVE-2026-45494, and CVE-2026-45495. The version visible in Tsai’s demonstration was 148.0.3967.54.
