Skip to content
Microsoft Edge Sandbox Exploit Revealed: Logic Bugs Lead to $175,000 Win

Microsoft Edge Sandbox Exploit Revealed: Logic Bugs Lead to $175,000 Win

First seen 29 Oct 2026, 03:34 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 04:08 UTC
  • •Orange Tsai exploited logic flaws in Microsoft Edge to escape its sandbox.
  • •The exploit earned $175,000 at Pwn2Own Berlin and was confirmed by multiple sources.
  • •Microsoft patched the vulnerabilities in May 2026, making updated Edge versions secure.

On October 28, 2026, Orange Tsai of DEVCORE disclosed a full exploit chain that escaped the Microsoft Edge sandbox using only logic flaws, earning $175,000 at Pwn2Own Berlin. The exploit involved chaining four logic bugs, with no memory corruption or AI used. Microsoft patched the vulnerabilities in May 2026, and updated versions of Edge are no longer vulnerable. The exploit was confirmed to be a significant achievement, nominated for a Pwnie Award for Epic Achievement. The full chain included five bugs and two Windows features, showcasing the effectiveness of manual bug hunting in an era dominated by AI solutions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-05-01
Microsoft patches Edge vulnerabilities
Microsoft released updates to fix multiple vulnerabilities in Edge, addressing the logic bugs exploited by Tsai.
Feeds.4Sysops
2026-10-28
Orange Tsai discloses exploit chain
Tsai revealed a full chain of logic bugs that allowed sandbox escape in Edge, leading to a significant financial reward.
blog.orange.tw

More articles in this cluster (2)

Following this threat?

Track Microsoft in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 2

Common questions

What vulnerabilities were exploited?
The exploit involved four logic bugs that allowed for a sandbox escape in Microsoft Edge.
Are the vulnerabilities still a threat?
No, Microsoft patched the vulnerabilities in May 2026, and updated Edge versions are secure.
How was the exploit achieved?
The exploit was achieved solely through logic flaws, without any memory corruption or AI involvement.