Logic Flaw Chain Bypasses Microsoft Edge Sandbox, Enables Code Execution – $175K Pwn2Own Reveal
What Happened — Security researcher Orange Tsai (DEVCORE) disclosed a chain of pure logic bugs in Microsoft Edge that, without any memory‑corruption primitive, lets a malicious web page execute native code outside the browser’s sandbox on Windows. The technique was demonstrated at the Pwn2Own Berlin contest in May 2026, earning a US $175,000 prize. Microsoft released patches the day after the contest, but the public write‑up shows that sandbox isolation can be subverted by non‑memory‑corruption flaws, expanding the threat landscape for browsers and any application that relies on similar containment mechanisms.
Why It Matters for Trust & Control Assurance — The incident tests the control objective of sandbox isolation and runtime protection; proving that your environment enforces effective isolation is essential for audit readiness.
Who Is Affected — All organizations that rely on Microsoft Edge (or similar Chromium‑based browsers) for employee web access, especially those in technology, finance, and regulated sectors.
Recommended Actions
- Verify that the latest Edge patches are deployed across all endpoints.
- Conduct a sandbox‑isolation validation test that includes logic‑flaw scenarios.
- Document remediation evidence and map it to your secure‑development and runtime‑control objectives.
Technical Notes
- Attack vector: logic‑flaw exploitation (no memory corruption).
- No CVE was assigned at time of disclosure; Microsoft issued an out‑of‑band security advisory.
- Affected component: Microsoft Edge rendering engine and sandbox enforcement module.