Edge broken with five logic bugs, zero memory corruption
Logic bugs are boring. Until someone stacks five of them into a chain and walks from the browser straight into the operating system.
Orange Tsai, principal researcher at Taiwan's DEVCORE, published the full attack he first demoed at Pwn2Own Berlin 2026. Details landed on 28 October. Inside: five logic flaws, zero memory corruption, arbitrary code execution on Windows at the end.
Five holes instead of one exploit
Classic exploits are about memory: overflows, use-after-free, ROP chains. Years of defenses aim exactly there — isolation, control-flow integrity, sandboxes. A logic flaw slips past all of it. The code does what it's written to do, just not what the author meant. Stack five of those, and the browser-to-system boundary stops holding.
Tsai, as iThome describes it, worked without AI. By hand. Meanwhile the industry keeps saying neural nets will soon eat all of fuzzing. A human took five logic bugs and reached code execution. Not an indictment of AI in security — a reminder of where automation still stalls. Machines find crashes. Humans assemble the meaning.
Why this isn't a routine bug
- Five logic flaws are not five separate CVEs; each step removes the limit set by the previous one.
- Windows features inside the chain mean the browser-system border is thinner than slide decks suggest.
- No memory corruption means it slips past detectors trained on crashes.
Who carries the cost
Microsoft has confirmed nothing officially — the cluster holds only the trade-press breakdown and contest material. But Pwn2Own is not an anonymous blog: judges saw the work, details are out. The argument isn't whether Edge fell. It's how fast a patch ships and how many corporate machines never get it.
Edge sits on millions of work laptops not because people love it, but because it's already installed. The fix is not one hole — it's a sequence, and memory defenses won't help even in theory.
💬 What to argue about
1. Publish such chains in full, or drip them out one CVE at a time? Where's the line between training defenders and handing attackers a manual?
2. Logic bugs get patched slower than memory bugs — what has to change so five-in-a-row is caught before release, not after a contest?
3. If AI fuzzers still can't assemble chains like this, keep funding them or fund people like Tsai?
Prediction: Microsoft will close part of the chain in upcoming updates, but will call it a set of ordinary vulnerabilities — the chain will live only in DEVCORE's writeup.
Disclaimer: not officially confirmed by Microsoft; details disclosed by researchers at Pwn2Own
Source: iThome Taiwan AI
🤖 AI summary
- Date: 2026-10-30
- Source: www.ithome.com.tw
- Tags: Edge, Windows, Security
- Key facts:
- Logic bugs are boring.
- Until someone stacks five of them into a chain and walks from the browser straight into the operating system.
- Orange Tsai, principal researcher at Taiwan's DEVCORE, published the full attack he first demoed at Pwn2Own Berlin 2026.
- Details landed on 28 October.
- Inside: five logic flaws, zero memory corruption, arbitrary code execution on Windows at the end.
- Classic exploits are about memory: overflows, use-after-free, ROP chains.
- Years of defenses aim exactly there — isolation, control-flow integrity, sandboxes.
- A logic flaw slips past all of it.
Source: www.ithome.com.tw · post in Telegram