How a Browser Hacker Won $175,000 Without a Single Memory Bug
Orange Tsai of DEVCORE has published the full chain that broke Microsoft Edge at Pwn2Own Berlin in May. Microsoft patched the holes the next day.
Key points
- Taiwanese researcher Orange Tsai of DEVCORE published the full Microsoft Edge exploit chain on October 28, 2026, five months after it won $175,000 at Pwn2Own Berlin in May.
- The attack used only logic flaws, meaning mistakes in how the browser's rules are written, with no memory corruption bugs of the kind that normally power browser breakouts.
- Microsoft fixed the Edge-specific bugs the day after the contest.
- A visitor who loaded a booby-trapped web page could end up with the attacker's code running on their Windows PC, outside the browser's protective sandbox.
A security researcher has shown that you don't need the usual heavy machinery to break out of a modern web browser. You just need the browser to trust the wrong thing.
Orange Tsai, a bug hunter at Taiwanese firm DEVCORE, published the full write-up of his Microsoft Edge attack on October 28. The chain earned him $175,000 at the Pwn2Own Berlin hacking contest in May 2026, where researchers are paid for breaking real software in front of judges. Microsoft shipped a fix for the Edge-specific bugs the day after the contest.
What actually happened here?
Tsai strung together several logic flaws, which are mistakes in the rules a program follows rather than mistakes in how it handles computer memory. A visitor who loaded a malicious page in Edge would end up with the attacker's code running on their Windows machine, outside the browser's sandbox. The sandbox is the walled-off area a browser uses to stop web pages from touching the rest of your computer.
That's the full nightmare scenario for a browser bug. Open a link, lose the machine.
What makes it unusual is the method. Most browser escapes rely on memory corruption, where attackers trick the program into scribbling over parts of its own memory it shouldn't touch. Those bugs are getting harder to find and harder to use, because browser makers have spent years adding defences. Tsai's chain sidestepped all of that. Every step was the browser doing exactly what its code told it to do, just in a sequence the designers never intended.
We covered Orange Tsai's work on 22,000 Microsoft Exchange servers still open to mailbox takeover flaw on 1 September 2026, a reminder that his research spans well beyond browser targets.
Am I still at risk if I use Edge?
No, not from this specific chain. Microsoft patched the Edge bugs the day after Pwn2Own in May, long before Tsai published the details on October 28. Anyone running a reasonably current version of Edge got the fix months ago through the browser's normal auto-update.
The practical advice is boring and correct: let Edge update itself, and restart the browser when it asks.
Why this one matters
My read, after watching browser exploits for years: this is the direction serious browser attacks are heading. The defences built to stop memory bugs do nothing against a chain of design mistakes. Logic bugs are quieter. They survive longer in code, and a researcher patient enough to map them can walk straight past the sandbox. Expect the next wave of high-value browser exploits, the kind sold to governments and used by ransomware crews for initial access, to look a lot more like Tsai's chain and a lot less like the memory corruption classics.
