Microsoft Edge 0-Click Exploit Chains Five Flaws to Execute Code and Escape Sandbox

Severity

High

Detail

Security researcher Orange Tsai of DEVCORE has disclosed a sophisticated exploit chain affecting Microsoft Edge that combines five distinct vulnerabilities and multiple Windows features to achieve remote code execution outside the browser sandbox. The exploit was demonstrated at Pwn2Own Berlin 2026 and reportedly required fewer than 100 lines of code to achieve full compromise.

This attack chain abuses a series of logic flaws and trusted browser features. The research demonstrates how multiple low-to-medium severity weaknesses can be chained together to bypass browser security boundaries and ultimately execute code on the underlying Windows operating system.

The attack begins by exploiting flaws in Edge’s Conditional Access navigation handling functionality and progresses through multiple security bypasses, including universal cross-site scripting (UXSS), cross-origin data exposure, privileged browser page abuse, path traversal, and protocol handler manipulation.

How?

The exploit chain starts with a logic flaw in Edge’s Conditional Access navigation handler which is responsible for helping users switch browser profiles when accessing Microsoft services. When a supplied email address matched the currently logged-in profile, Edge initiated a new navigation process using an attacker-controlled destination. Due to insufficient tab binding validation, JavaScript originating from one browser context could execute within another website’s context resulting in UXSS.

The browser process initiated the navigation, allowing the attack to bypass certain Content Security Policy (CSP) restrictions that would normally prevent unauthorized script execution. Additional flaws allowed the attacker to bypass trust checks intended to restrict navigation requests to legitimate Microsoft websites. A hardcoded popup exception further enabled browser windows to be opened without requiring user interaction.

The chain then relied on a cross-origin resource sharing (CORS) misconfiguration on assets[.]msn[.]com allowing the attack to expose the email address associated with a signed-in Edge profile. Once browser-level restrictions were bypassed, the attacker targeted Edge’s Immersive Reader functionality. The privileged read:// scheme failed to properly block JavaScript URLs, exposing an internal diagnostic feedback function.

Researchers abused path traversal and null-byte handling weaknesses to write files outside intended directories and remove enforced file extensions. The final stage involved modifying protocols[.]json, an Edge configuration file that controls which websites are permitted to invoke external protocol handlers.

By manipulating this configuration and abusing the Windows telnet protocol handler, the attacker achieved code execution outside Edge’s sandbox. A malicious executable placed in a writable directory searched by Windows was ultimately launched through the protocol invocation process.

Conclusion

The exploit chain disclosed by Orange Tsai highlights how multiple seemingly minor logic flaws can be chained together to achieve significant security impact. By combining UXSS, cross-origin data exposure, privileged browser page abuse, path traversal, and Windows protocol handler manipulation, the researcher demonstrated a path from malicious web content to code execution outside the browser sandbox without relying on memory corruption vulnerabilities.

Organizations should ensure that Microsoft Edge is updated with the latest security patches released by Microsoft. Security teams should also monitor for suspicious browser behaviour, unauthorized modifications to Edge configuration files, abnormal protocol handler activity, and execution of unexpected processes originating from browser-related workflows. The research serves as a reminder that browser security depends not only on memory safety but also on the secure interaction between browser features, identity services, and operating system components.

Source

https://cybersecuritynews.com/microsoft-edge-zero-click-exploit/