The attack achieved full compromise by linking five distinct logic bugs alongside two underlying Windows features. A key component of the chain involved targeting the EdgeCAGuidanceNavigationThrottle, a specialized enterprise Entra ID mechanism inside Microsoft Edge. Because this feature issues navigation commands directly through the browser process after comparing email parameters, it enabled unrestricted access to forbidden browser-level schemes. Tsai subsequently presented technical breakdowns of the exploit chain at both HITCON and Hexacon.
Key points
Microsoft Edge can be fully compromised using purely logic-based flaws instead of traditi…: Microsoft Edge can be fully compromised using purely logic-based flaws instead of traditional memory corruption techniques.
Enterprise integration features like Entra ID navigation throttles introduce privileged b…: Enterprise integration features like Entra ID navigation throttles introduce privileged browser pathways that attackers can abuse.
Security researchers successfully bypassed standard browser restrictions without relying…: Security researchers successfully bypassed standard browser restrictions without relying on automated artificial intelligence tools.
Sources checked by our analysis pipeline: 1
I think I should still dump some of my work once in a while, even though it feels like fewer and fewer people actually sit down and read articles these days (or maybe now they all leave it to their agents XD). Anyway, this is what I built for Pwn2Own Berlin 2026 — a completely handmade, logic-only Microsoft Edge Full Chain, with no memory corruption, and no AI at all! 🔥
Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin https://t.co/vJaIpGG4cD
— TrendAI Zero Day Initiative (@thezdi) May 14, 2026
The whole chain is made up of five bugs and two Windows features. I have also shared the whole bug-hunting and chaining process at this year’s HITCON and Hexacon, plus some fun stories along the way. You can check the slides here!
Also, maybe everyone thinks LLMs can already pwn everything in the AI era, so something made entirely by hand somehow feels a bit more…
Speaking at the Russia-Africa Summit in Moscow, the Russian leadership emphasized the necessity of maintaining orbit discipline and mutual understanding with American partners to prevent operational interference in space. Engagement with the SpaceX chief continues despite broader geopolitical tensions, even as Moscow pushes forward with its own low Earth orbit network. This dynamic unfolds amid sharp friction over satellite access across the frontlines in Eastern Europe.
The tech giant's unveiling of a touchscreen MacBook Pro with an OLED display reverses longstanding executive resistance to hybrid computing designs. Under the leadership of chief executive Ternus, the move aims to modernize the Mac lineup alongside other recent experimental hardware debuts. However, the system faces scrutiny over whether users will embrace touch displays over traditional computational improvements.
Activists have published work records of federal personnel in a searchable database named Icepick to challenge the anonymity of enforcement agents during a broader immigration crackdown. The compromise exposed names, job titles, and contact information across multiple agencies, heavily impacting border protection and immigration enforcement divisions. Federal authorities have launched an active response to evaluate the threat posed to their workforce.