--- title: Forging a Microsoft Edge Full Chain with Logic Bugs Only description: Orange Tsai built a complete Microsoft Edge exploit chain using five logic bugs and two Windows features, with no memory corruption and no AI, for Pwn2Own... canonical: https://daily.dev/posts/forging-a-microsoft-edge-full-chain-with-logic-bugs-only-tsb4foulu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Forging a Microsoft Edge Full Chain with Logic Bugs Only | daily.dev og:description: Orange Tsai built a complete Microsoft Edge exploit chain using five logic bugs and two Windows features, with no memory corruption and no AI, for Pwn2Own... og:url: https://daily.dev/posts/forging-a-microsoft-edge-full-chain-with-logic-bugs-only-tsb4foulu og:image: https://api.daily.dev/og/posts/TSB4foULu.png og:image:alt: Forging a Microsoft Edge Full Chain with Logic Bugs Only og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Forging a Microsoft Edge Full Chain with Logic Bugs Only **[Hacker News](https://daily.dev/sources/hn)** · 15 min read · 0 upvotes · 0 comments ## Summary Orange Tsai built a complete Microsoft Edge exploit chain using five logic bugs and two Windows features, with no memory corruption and no AI, for Pwn2Own Berlin 2026. The chain starts with a UXSS primitive discovered in Edge's EdgeCAGuidanceNavigationThrottle, which initiates a sourceless browser-process navigation that ignores CSP and can target any origin. From there, an arbitrary file write via Immersive Reader's zipDiagnosticLogFiles (with path traversal and null-byte extension bypass) enables overwriting protocols.json to auto-launch telnet://, achieving ACE in under 100 lines of code. The chain was nominated for the Pwnie Awards and won the Epic Achievement award, and the research took two months. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is a sourceless navigation UXSS and how does it work in Chromium? A sourceless navigation UXSS occurs when Chromium's Navigate() is called from the Browser Process without specifying source_contents, causing it to default to the current active tab as the renderer source. If the active tab has changed since the navigation was triggered, JavaScript executes in the context of whatever origin is now active, bypassing same-origin restrictions. Even Chromium's own example code in browser_navigator_params.h gets this wrong by leaving source_contents as NULL. _Researchers tracking new browser attack surfaces find writeups like this on daily.dev._ ### How can the Microsoft Edge popup blocker be bypassed using a hardcoded whitelist? Microsoft Edge contains a hardcoded whitelist of URLs that bypass the popup blocker. Opening a window with the whitelisted URL about:blank#quickAuthPopup is allowed without user interaction, and the popup can then be navigated to any target. This internal whitelist, likely added for Microsoft's own features, effectively grants any attacker-controlled page the ability to open popups that would otherwise be blocked. _Developers building Edge extensions or web apps that depend on popup behavior track Edge-specific quirks on daily.dev._ ### How does the Microsoft Edge Immersive Reader read:// scheme enable arbitrary file write? Edge's Immersive Reader uses a custom read:// scheme that Microsoft omitted from Chromium's not_allowing_javascript_urls_schemes blacklist, making it accessible via UXSS. From that privileged context, chrome.edgeFeedbackPrivate.zipDiagnosticLogFiles() accepts a filename and JSON content, and is vulnerable to path traversal via ../ and null-byte injection to strip the forced .json extension, enabling arbitrary file write to any location the browser process can reach. _Security engineers auditing browser-level privilege boundaries follow research like this on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 3 discussions and 35 comments across hackernews, lobsters (as of 2026-10-29). **TL;DR:** The exploit chain itself draws strong admiration for its elegance and clarity, while a side debate flares up over an offhand remark about AI assisting the research (which commenters later clarify wasn't the case), and several are unsettled by the underlying Edge behaviors the bugs exploit. **Sentiment:** 65% positive · 30% mixed · 5% skeptical **The case for** - The write-up is praised as clear, concise, and well explained despite the technical depth. - Each individual logic bug (e.g. the UXSS) is seen as significant and impressive on its own. - People appreciate that it's low-level craft (no memory corruption, no AI) rather than brute-force tooling. **The pushback** - An early line implying readers could just 'ask an agent' for details triggered backlash before people realized no AI was actually used. - Some are disturbed that visiting a site can silently sign a user into a browser profile and leak their email via a simple fetch with credentials. - A few see this as evidence of careless feature integration between browsers and sites that opens up many security holes. **By community** - hackernews (mixed): A heated side-thread about an AI-related line gives way to broad praise for the writing and the chain once people clarify no AI was used, alongside genuine unease about the sign-in/email-leak behavior described. - lobsters (positive): Commenters are impressed by how simple and significant each bug is in isolation and praise the write-up. **Hottest debate:** Whether an offhand remark suggesting readers could 'ask an agent' to fill in details was a fair reason to dismiss the piece, before several pointed out the research explicitly used no AI. **Open questions** - Is the automatic sign-in-on-visit behavior in Edge intentional default behavior or a bug, and does an equivalent exist by default in other browsers? **Highlights** > If you continued to read the article, you would discover that he indeed goes through his entire thought process in building this chain. Including the fact this was done with no AI assistance at all. > — [russelg on hackernews · 1 comments](https://news.ycombinator.com/item?id=50286761) > Orange is a legend and this chain is extremely impressive here. No memory corruptions, no heap shenanigans, just pure logic bugs, almost made easy to understand for the reader. As a bonus, they also posted a reverse chain: popping Edge from calc [0]. [0] https://www.youtube.com/watch?v=Bh1zglq4mLE > — [darkamaul on hackernews](https://news.ycombinator.com/item?id=50286550) > > So even if you’ve never created a User Profile in the browser, just visiting www.microsoft.com is enough for Edge to create one and sign you in automatically. This is disgusting behaviour, RCE chain or not. > — [tveita on hackernews](https://news.ycombinator.com/item?id=50287278) > > with a simple fetch(...) with credentials included, you can easily grab any Microsoft Edge user’s email from any website Wow, this is disturbing on its own > — [adzm on hackernews](https://news.ycombinator.com/item?id=50289458) > Yes incredible! I think a UXSS is basically a critical by itself! Orange has a long history of putting great bugs out there. I love the write-up, :D I like how Microsoft have done the wrong thing at every turn here. > — [SamRW on lobsters · 3 points](https://lobste.rs/s/ansfvi/forging_microsoft_edge_full_chain_with#c_tkei0f) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50285319) · 175 points · 33 comments - [hackernews](https://news.ycombinator.com/item?id=50273665) · 3 points · 0 comments - [lobsters](https://lobste.rs/s/ansfvi/forging_microsoft_edge_full_chain_with) · 31 points · 2 comments ## Similar posts on daily.dev - [Windows 11 and Microsoft Edge hacked at Pwn2Own Berlin 2026](https://daily.dev/posts/windows-11-and-microsoft-edge-hacked-at-pwn2own-berlin-2026-8irxbbnyy) · BleepingComputer · 0 upvotes · 0 comments - [Claude Opus wrote a Chrome exploit for $2,283](https://daily.dev/posts/claude-opus-wrote-a-chrome-exploit-for-2-283-vrq54wsru) · The Register · 1 upvotes · 0 comments - [The researcher Microsoft threatened just dropped a seventh Windows zero-day hours after Patch Tuesday](https://daily.dev/posts/the-researcher-microsoft-threatened-just-dropped-a-seventh-windows-zero-day-hours-after-patch-tuesda-l1aucgx7d) · The Next Web · 1 upvotes · 0 comments - [Pwn2Own Berlin 2026: On the Ground with ZDI's Biggest AI Showdown Yet](https://daily.dev/posts/pwn2own-berlin-2026-on-the-ground-with-zdi-s-biggest-ai-showdown-yet-xfyxuypgz) · Trend Micro · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#chromium](https://daily.dev/tags/chromium), [#microsoft-edge](https://daily.dev/tags/microsoft-edge) [View this post on daily.dev](https://daily.dev/posts/forging-a-microsoft-edge-full-chain-with-logic-bugs-only-tsb4foulu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Forging a Microsoft Edge Full Chain with Logic Bugs Only","url":"https://daily.dev/posts/forging-a-microsoft-edge-full-chain-with-logic-bugs-only-tsb4foulu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/forging-a-microsoft-edge-full-chain-with-logic-bugs-only-tsb4foulu"},"datePublished":"2026-10-29T11:11:40.206Z","dateModified":"2026-10-29T14:57:53.474Z","description":"Orange Tsai built a complete Microsoft Edge exploit chain using five logic bugs and two Windows features, with no memory corruption and no AI, for Pwn2Own...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/81ee5f95ae513bdf7a4fddf34ca4d4ce?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/81ee5f95ae513bdf7a4fddf34ca4d4ce?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/forging-a-microsoft-edge-full-chain-with-logic-bugs-only-tsb4foulu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,chromium,microsoft-edge","timeRequired":"PT15M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Forging a Microsoft Edge Full Chain with Logic Bugs Only"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/forging-a-microsoft-edge-full-chain-with-logic-bugs-only-tsb4foulu#faq","mainEntity":[{"@type":"Question","name":"What is a sourceless navigation UXSS and how does it work in Chromium?","acceptedAnswer":{"@type":"Answer","text":"A sourceless navigation UXSS occurs when Chromium's Navigate() is called from the Browser Process without specifying source_contents, causing it to default to the current active tab as the renderer source. If the active tab has changed since the navigation was triggered, JavaScript executes in the context of whatever origin is now active, bypassing same-origin restrictions. Even Chromium's own example code in browser_navigator_params.h gets this wrong by leaving source_contents as NULL. Researchers tracking new browser attack surfaces find writeups like this on daily.dev."}},{"@type":"Question","name":"How can the Microsoft Edge popup blocker be bypassed using a hardcoded whitelist?","acceptedAnswer":{"@type":"Answer","text":"Microsoft Edge contains a hardcoded whitelist of URLs that bypass the popup blocker. Opening a window with the whitelisted URL about:blank#quickAuthPopup is allowed without user interaction, and the popup can then be navigated to any target. This internal whitelist, likely added for Microsoft's own features, effectively grants any attacker-controlled page the ability to open popups that would otherwise be blocked. Developers building Edge extensions or web apps that depend on popup behavior track Edge-specific quirks on daily.dev."}},{"@type":"Question","name":"How does the Microsoft Edge Immersive Reader read:// scheme enable arbitrary file write?","acceptedAnswer":{"@type":"Answer","text":"Edge's Immersive Reader uses a custom read:// scheme that Microsoft omitted from Chromium's not_allowing_javascript_urls_schemes blacklist, making it accessible via UXSS. From that privileged context, chrome.edgeFeedbackPrivate.zipDiagnosticLogFiles() accepts a filename and JSON content, and is vulnerable to path traversal via ../ and null-byte injection to strip the forced .json extension, enabling arbitrary file write to any location the browser process can reach. Security engineers auditing browser-level privilege boundaries follow research like this on daily.dev."}}]} ```