The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!
Summary
Orange Tsai documents a logic-only chain to break out of the Microsoft Edge sandbox, demonstrated at Pwn2Own Berlin 2026. The article outlines five bugs and two Windows features used to achieve a sandbox escape, including navigation throttles, UXSS primitives, OneAuth, and protocol-handling abuse, and ends with reflections on AI-free vulnerability research and future work.