Full Edge sandbox escape method goes public; bugs already fixed
Orange Tsai of DEVCORE published the full method on October 28, five months after the chain won $175,000 at Pwn2Own Berlin. The chain uses only logic flaws, with no memory corruption, to run code on Windows outside Microsoft Edge's sandbox. Microsoft fixed the bugs the day after the contest.
What happened
A researcher published the full method on October 28 for an attack that runs code on a computer from a malicious web page, escaping Microsoft Edge's security isolation. The technique uses logic flaws alone, with no memory corruption. It won Pwn2Own Berlin in May with a $175,000 prize, and Microsoft fixed the bugs the day after the contest.
Why it matters
All it takes is one user opening a malicious page for an attacker to run code on Windows, outside the browser's protections. With the full method public, copycat attacks against unpatched Edge installs become more likely. Companies that keep the browser updated have Microsoft's fix.
What to do
Update Microsoft Edge on all endpoints to a patched version, released by Microsoft the day after Pwn2Own Berlin in May. Confirm automatic browser updates are enabled across the fleet.
For the technical team
- Affected
- Microsoft Edge (sandbox do navegador) · Microsoft Edge (browser sandbox). Affected versions not cited in the sources.
- Exploitation
- No in-the-wild exploitation reported in the sources. The chain was demonstrated by Orange Tsai of DEVCORE at Pwn2Own Berlin in May, winning $175,000. The full method was published on October 28 and serves as a public proof of concept. No KEV mention.
- Fix
- Microsoft fixed the Edge bugs the day after Pwn2Own Berlin, according to The Hacker News. Specific fixed versions not cited in the sources.
- Vector
- Microsoft Edge sandbox. A chain of logic flaws, with no memory corruption, turns a malicious web page into code execution on Windows outside the sandbox. Cited condition: the victim opens a malicious web page; no other condition cited in the sources.
- More details
- Discoverer and demonstrator: Orange Tsai of DEVCORE. The chain relies solely on logic flaws. Method published on October 28, five months after the contest win. Sources: The Hacker News (article and X post).
Timeline
Batch details authorship by Orange Tsai (DEVCORE), the $175,000 Pwn2Own Berlin prize, and confirms Microsoft already fixed the bugs.
Incident opened.
Sources 2 sources
- @TheHackersNews @TheHackersNews
- Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win The Hacker News
