Microsoft Edge Logic Bug Enables Sandbox Escape in Pwn2Own $175,000 Win

Microsoft Edge Logic Bug Enables Sandbox Escape

Microsoft Edge users on versions before the May 2026 patch are exposed to a chain of logic bugs that can break the browser sandbox and execute code on the host system. The chain was demonstrated at Pwn2Own Berlin, earning the contestant $175,000, and was patched the day after the contest.

Attack Path Overview

1. Conditional Access Navigation Throttle – A feature for business sign-ins triggers a navigation that is not tied to the originating page. The browser attaches this navigation to any open tab, creating a mismatch that produces a UXSS (universal cross-site scripting) primitive.
2. Trusted Site Check Bypass – Edge verifies that navigation requests originate from a trusted Microsoft domain. The attacker opens the request from a second window; Edge’s popup blocker is bypassed because the domain is hard-coded in a whitelist.
3. Popup Window Exploit – The second window opens a popup that Edge allows because the domain is on the whitelist. This popup initiates the navigation that carries the malicious payload.
4. Signed-In Requirement – The chain relies on the user being signed in to Edge. The conditional access throttle only activates for authenticated sessions.
5. Browser Restart (Convenience Step) – The final step restarts Edge to complete the escape. This step is unnecessary for a real attack and was included only for contest convenience.

Exposure and Evidence

• The exploit was performed live at Pwn2Own Berlin in May 2026. No evidence of wild-world exploitation exists.
• Microsoft released a patch the day after the contest, closing all logic flaws involved.
• The public CVE database lists no exploitation entries; the vulnerability is marked as none.

Mitigation

• Update Edge – Install the latest Edge release (post-May 2026 patch). The patch removes the conditional access throttle logic and hard-coded whitelist.
• Disable Conditional Access Features – If updating is delayed, disable business sign-in features in Edge settings to remove the initial trigger.
• Monitor for Unusual Popups – The chain relies on a popup from a whitelisted domain. Monitor for unexpected popups from Microsoft domains.

Technical Details

• The entire exploit chain is under 100 lines of JavaScript.
• No memory corruption or buffer overflow is involved; the attack exploits logical inconsistencies in navigation handling.
• The attack can reach any site, including high-profile domains like google.com, because it originates from Edge’s own process.

Operational Impact

• Systems with unpatched Edge are vulnerable to a full-system compromise via a crafted web page.
• The logic-only nature of the exploit means traditional memory-corruption mitigations (ASLR, DEP) do not prevent it.
• Organizations relying on Edge for internal or customer-facing applications should prioritize patching.

Next Steps for Engineers

1. Verify Edge version on all endpoints.
2. Apply the latest update immediately.
3. Disable conditional access navigation throttle if patching cannot occur.
4. Review browser logs for unexpected navigation or popup events.

Related Resources

For a broader view of zero-day exploitation patterns, see the Zero-Day Vulnerability & CVE Exploit Matrix.

Related Coverage

• FortiBleed 2.0 Exposes 40,573 Secrets, PHP2Shell Scanning Continues, and 26 Other Threats Detected
• Claude Code Extension Compromise Exposes VS Code Users to Persistent SSH Backdoor

Explore More on This Topic

• More edge coverage

Related coverage

• Yoba Crypto Miner Campaign Uses Signed AI Binaries to Deploy Malicious DLLs
• PHP2Shell RCE Exploits Force Immediate Patch for Millions of Sites