Microsoft Edge · Public exploit code

Five logic bugs chained into RCE in Microsoft Edge

Nov 05, 2026 · 1 min read

A DEVCORE researcher presented a complete chain of five logic bugs in Microsoft Edge, combined with two Windows features, going from JavaScript execution on any website to arbitrary code execution on the system. The starting point is the Navigation Throttles mechanism, notably the EdgeCAGuidanceNavigationThrottle, part of the enterprise Entra ID feature. The source does not say whether the bugs are fixed; apply the latest Edge updates and watch for further advisories.

By HIFY Radar newsroom Updated 11/05/2026 07:43 AM Get this every day →← Back to the feed 1 source

HighVulnerabilityPublic exploit codeFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A DEVCORE researcher presented a complete chain of five logic flaws in Microsoft Edge that, with two Windows features, allows arbitrary code execution on the computer. The attack starts with JavaScript on any website the victim visits.

Why it matters

If exploited, visiting a compromised site can lead to full control of the machine. The chain relies on a signed-in Microsoft account; starting with Windows 11 25H2, signing in to Windows requires an MSA account, which makes that requirement common.

What to do

The source does not state a fix. Apply the latest Edge update across the fleet and monitor advisories from Microsoft and DEVCORE about these flaws.

For the technical team

Affected: Microsoft Edge · Microsoft Edge; versions not specified in the source. The signed-in profile requirement is eased on Windows 11 25H2, where signing in to Windows requires an MSA account unless a local-account workaround is used.
Exploitation: No exploitation reported in the source. The complete chain was presented by a DEVCORE researcher in a technical write-up on dbugs.
Fix: The source does not state fixed versions, patch, or mitigation.
Vector: Five logic bugs in Edge plus two Windows features. Initial trigger: the Navigation Throttles mechanism in the browser process; the EdgeCAGuidanceNavigationThrottle (enterprise Entra ID feature) cancels the original navigation and launches a new one using the address in switch_profile. Because the new navigation is initiated by the browser process, it can reach pages normally inaccessible to JavaScript, including edge:// and javascript: URLs. Initial condition: JavaScript execution on an arbitrary website (UXSS primitive).
More details: Bypass of the four described obstacles: (1) trusted origin checked via GetLastCommittedURL of the current tab; navigation initiated from another window bypasses the check. (2) Edge's own pop-up allowlist permits a window opened with about:blank#quickAuthPopup, which is then redirected to any website. (3) The OneAuth feature automatically signs users in to their Microsoft accounts on Microsoft websites; simply visiting a Microsoft website is enough for Edge to create a profile and sign in. (4) Requirement for prior knowledge: the source text is cut off at this point. Discovery and disclosure by a DEVCORE researcher; the post cites no dates or CVEs.