> As a bonus, they also posted a reverse chain: popping Edge from calc [0].
What the hell is going on there? Apparently they are spawning new and new and new instances of calc.exe until one random (?) instance is vulnerable to some sort of attack, then they inject some shellcode into it from outside, and manage to trigger it by inputting "1"s until there's an overflow?
Really looking forward to the writeup lol
its-summertime 1 days ago [-]
I always felt bad about the whole site/browser cross integration that chrome and edge and others do. Now I feel really really really bad about it. Can almost see the marketing team's emails about what features to add, and the developers unwantingly writing the code not expecting such things to open so many holes
xnickb 1 days ago [-]
I think they very well understand that this code was full of bugs but no one cared. Likely was assigned to some junior who was making an entry into the team/repos as a non-critical task.
And it's hard to judge them: I'd also rather focus on real features.
imtringued 24 hours ago [-]
What?
Special casing your domains to be assumed "secure" is exactly how you build vulnerabilities directly into your software.
It's an inevitable result.
Developers aren't aware because they assume a security model where the special casing is disabled.
antonly 1 days ago [-]
It's very refreshing to read such clearly written and concise technical reports.
layer8 1 days ago [-]
No “here’s why it matters” and friends, thankfully.
adzm 1 days ago [-]
> with a simple fetch(...) with credentials included, you can easily grab any Microsoft Edge user’s email from any website
Wow, this is disturbing on its own
MatthiasPortzel 22 hours ago [-]
I was shocked at the popup blocker bypass, then the UXSS. Really impressive endurance to take this all the way to ACE.
tveita 1 days ago [-]
> So even if you’ve never created a User Profile in the browser, just visiting www.microsoft.com is enough for Edge to create one and sign you in automatically.
This is disgusting behaviour, RCE chain or not.
deburo 1 days ago [-]
I guess that explains the questions I had when I was mysteriously logged into Edge. I checked whether Chrome does something similar, and it can, but the setting "Sign in to Chrome when you sign in to other Google services" was set to "Don't sign in", so I'm not sure whether this is the default or not.
zhiyan 1 days ago [-]
human craft is becoming rare these days
Geezus_42 1 days ago [-]
Has been for a long time.
cubefox 1 days ago [-]
It's more that LLMs increasingly outperform humans in finding vulnerabilities, so the share of human discoveries goes down.
account42 1 days ago [-]
That's downplaying how LLMs discourage humans from thinking themselves by providing an easier "good enough" path.
LoganDark 1 days ago [-]
seconding this. it's even worse for those with executive dysfunction where it becomes too difficult to force one's self to continue taking what is now the long way around. even if you could do it so much better with time and practice.
cubefox 1 days ago [-]
That's downplaying the massive increase in LLM capabilities relative to the modest decrease in human capabilities.
ShinyLeftPad 1 days ago [-]
That's downplaying the importance of human capabilities.
akersten 23 hours ago [-]
Glad to now have some hard evidence I can reference whenever I bring up my strongly held intuitive opinion of "Microsoft repackaging someone else's browser and adding some extra stuff to it can only make Edge strictly worse"
1 days ago [-]
mschuster91 23 hours ago [-]
Oh dear god, at each further chain link I was laughing so hard that my poor cats got disturbed!
This entire chain is nothing but a lesson of shame for Microsoft - if you fork a thing, better be prepared to thoroughly understand and review each corner you touch. Or you might miss important cross-references that you should update but that aren't mentioned in comments by the original developers.
As for the "sign in automatically" BS that both Google and Edge push - that can go and die in a hellfire where it belongs.
sharpshadow 1 days ago [-]
The popup nightmare never stops.
Vaushite 1 days ago [-]
This is very awesome and cool.
breakingcups 1 days ago [-]
This is amazing work.
berofeev 1 days ago [-]
Excellent write up
1vuio0pswjnm7 23 hours ago [-]
A good summary of the so-called "modern" browser
But what hapens when there's no Javascript interpreter, i.e., not the so-called "modern" browser
And when the OS is not Windows
The so-called "modern" browser _is_ a "logic bug". It's multiple layers of stupidity if "security" is a goal
1vuio0pswjnm7 21 hours ago [-]
Designed for data collection, surveillance and advertising
cyclopeanutopia 1 days ago [-]
Stopped at
> I won’t go into too much detail in this post, because I think in this era, you can just ask your agents to fill in the details :)
russelg 1 days ago [-]
If you can understand nuance and context, you would realise the phrase right before that is saying that he's not going to go into details about how navigation itself works in Chrome/Edge, and to watch the presentation from Google itself about those specific details if you are so inclined.
If you then continued on to read the remainder of the article, you would also discover that there was no AI assistance in this research at all.
est 1 days ago [-]
It's your loss. The whole article is very good written.
ncruces 1 days ago [-]
And much better for not going into needless detail.
In fact, a problem with LLMs is that they consistently write more than I want to read.
cush 22 hours ago [-]
It’s actually super detailed. That sentence might as well not exist
maeln 1 days ago [-]
The article does actually go pretty in detail about the exploit.
MonkeyClub 1 days ago [-]
Same; either put in the work to think it through and show us your thought process and conclusions, or just post your prompts and call it a day and everyone gets to move on.
russelg 1 days ago [-]
If you continued to read the article, you would discover that he indeed goes through his entire thought process in building this chain. Including the fact this was done with no AI assistance at all.
MonkeyClub 1 days ago [-]
I stand corrected then, I’ll return to it!
john_strinlai 23 hours ago [-]
it's sort of funny, because before you even get to the line you stopped at, and then assumed that they used ai, you have to read this part:
"Anyway, this is what I built for Pwn2Own Berlin 2026 — a completely handmade, logic-only Microsoft Edge Full Chain, with no memory corruption, and no AI at all!"
cyclopeanutopia 3 hours ago [-]
My beef is with something else, but seeing the comments I'm sure none of you people will understand.
Time to leave this stupid place full of stupid people. So long, and thanks for nothing!
whoanoway 3 hours ago [-]
[dead]
tsujamin 1 days ago [-]
Imagine missing such a great bug-chain because an off-hand AI comment at the start put you off
No memory corruptions, no heap shenanigans, just pure logic bugs, almost made easy to understand for the reader.
As a bonus, they also posted a reverse chain: popping Edge from calc [0].
[0] https://www.youtube.com/watch?v=Bh1zglq4mLE
What the hell is going on there? Apparently they are spawning new and new and new instances of calc.exe until one random (?) instance is vulnerable to some sort of attack, then they inject some shellcode into it from outside, and manage to trigger it by inputting "1"s until there's an overflow?
Really looking forward to the writeup lol
And it's hard to judge them: I'd also rather focus on real features.
Special casing your domains to be assumed "secure" is exactly how you build vulnerabilities directly into your software.
It's an inevitable result.
Developers aren't aware because they assume a security model where the special casing is disabled.
Wow, this is disturbing on its own
This is disgusting behaviour, RCE chain or not.
This entire chain is nothing but a lesson of shame for Microsoft - if you fork a thing, better be prepared to thoroughly understand and review each corner you touch. Or you might miss important cross-references that you should update but that aren't mentioned in comments by the original developers.
As for the "sign in automatically" BS that both Google and Edge push - that can go and die in a hellfire where it belongs.
But what hapens when there's no Javascript interpreter, i.e., not the so-called "modern" browser
And when the OS is not Windows
The so-called "modern" browser _is_ a "logic bug". It's multiple layers of stupidity if "security" is a goal
> I won’t go into too much detail in this post, because I think in this era, you can just ask your agents to fill in the details :)
If you then continued on to read the remainder of the article, you would also discover that there was no AI assistance in this research at all.
In fact, a problem with LLMs is that they consistently write more than I want to read.
"Anyway, this is what I built for Pwn2Own Berlin 2026 — a completely handmade, logic-only Microsoft Edge Full Chain, with no memory corruption, and no AI at all!"
Time to leave this stupid place full of stupid people. So long, and thanks for nothing!