Orange Tsai of DEVCORE chains 4 handcrafted logic bugs to escape Microsoft Edge sandbox at Pwn2Own Berlin 2026, wins $175K and Pwnie Award; exploits forgotten Navigation Throttles in Edge's Entra ID feature

Orange Tsai of DEVCORE chains 4 handcrafted logic bugs to escape Microsoft Edge sandbox at Pwn2Own Berlin 2026, wins $175K and Pwnie Award; exploits forgotten Navigation Throttles in Edge's Entra ID feature—no memory corruption or AI used.

The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!

I think I should still dump some of my work once in a while, even though it feels like fewer and fewer people actually sit down and read articles these days (or maybe now they all leave it to their agents XD). Anyway, this is what I built for Pwn2Own Berlin 2026 — a completely handmade, logic-only Microsoft Edge Full Chain, with no memory corruption, and no AI at all! 🔥 Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on ...