Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win

A security researcher demonstrated that a series of logic flaws can be used to execute code on a Windows computer outside of Microsoft Edge's sandbox, starting from a malicious web page. This was achieved without exploiting any memory corruption vulnerabilities. The researcher, Orange Tsai of DEVCORE, publicly disclosed the full details of the method, which had previously been used to win $175,000 at the Pwn2Own Berlin contest. Microsoft had already fixed the vulnerabilities in Edge the day after the contest took place. The disclosure provides insight into how logic bugs can be used to bypass security measures. The vulnerabilities were fixed by Microsoft in May, following the contest.