Forging a Microsoft Edge Full Chain with Logic Bugs Only

A closer look at Forging a Microsoft Edge Full Chain with Logic Bugs Only

What this write-up is about

This post documents a handcrafted, logic-only Microsoft Edge full chain that was built for Pwn2Own Berlin 2026. The author describes chaining logic bugs (no memory corruption) to escape Edge’s sandbox, and explains parts of the bug-hunting and chaining process that led to that result.

What you can read and follow on the page

The article walks through the navigation flow in Chromium and focuses on a thinly attended area called Navigation Throttles, pointing out an Edge-specific throttle named EdgeCAGuidanceNavigationThrottle used for Conditional Access (Entra ID). It explains how that throttle inspects an email parameter and can cancel and relaunch navigations with an attacker-controlled query string when certain conditions are met.

The author demonstrates how relaunching navigation from the browser process without binding a renderer source can produce a UXSS (Universal Cross-Site Scripting) primitive by letting Chromium use the current active tab as the implicit source. The post also lists practical challenges to weaponizing the UXSS (for example the requirement that the throttle be fired from specific Microsoft origins) and shows bypass techniques such as using cross-window navigation to bypass origin checks.

Who will find this useful

People who study browser internals, Chromium navigation, or browser security research will get concrete, technical insight into a logic-only exploitation path and the reasoning the author used to chain bugs. Developers and auditors interested in navigation throttles and origin checks may find the concrete failure modes and code-path references helpful for auditing. The content assumes familiarity with browser architecture and security concepts.

Questions people ask about Forging a Microsoft Edge Full Chain with Logic Bugs Only

Does the post include slides or other presentation material?

Yes, the author says the bug-hunting and chaining process was shared at HITCON and Hexacon and that slides are available to check.

Is this exploit based on memory corruption?

No, the write-up emphasizes the chain is logic-only and does not rely on memory corruption.

Which specific Edge component was involved?

The post identifies EdgeCAGuidanceNavigationThrottle, part of Edge’s Conditional Access guidance logic, as a key component involved in the chain.

Forging a Microsoft Edge Full Chain with Logic Bugs Only was shared on NexURLs by Nexis on November 2, 2026, in Scary & Creepy.