**

Some of the most impressive hacks do not smash through a wall. They find the doors that were left ajar. Security researcher Orange Tsai of DEVCORE has now published the full method behind a Microsoft Edge exploit chain that escaped the browser's sandbox using only logic errors, with no memory corruption anywhere in the attack. The chain won $175,000 at the Pwn2Own Berlin contest in May 2026 and later took the Epic Achievement prize at the Pwnie Awards.

The work matters because browser escapes usually depend on memory corruption: a crash, a corrupted pointer, or a carefully groomed heap. Tsai's chain, built over two months of manual research without artificial intelligence tools, used fewer than 100 lines of code. It began with an Edge feature that helps business users reach the correct browser profile when signing in to Microsoft services.

From a crossed wire to full code execution

That mismatch produced a universal cross-site scripting primitive: a way to run JavaScript in the context of other websites, bypassing the content security policies that normally keep sites apart. Four further weaknesses then removed the need for user interaction, including a popup exception and automatic sign-in behaviour, and the chain ultimately broke out of the sandbox to run code on Windows itself.

Tsai deliberately held the write-up until Microsoft had patched the flaws, publishing it on 28 October 2026, five months after the contest demonstration. Microsoft fixed the Edge bugs the day after the contest, according to the reports.

Why readers should not panic, but should update

This is a competition exploit, not an attack seen in the wild, and there is no evidence it has been used against real users. An up-to-date browser is not at risk from this chain. The lesson is broader than one browser: ordinary features, each harmless on its own, can combine into a serious escape route when their interactions are not checked.

Sources: The Hacker News; Cybersecurity News.