Logic Flaws Enable Exploitation of Microsoft Edge Without Memory Corruption, Securing $175,000 Pwn2Own Prize

A researcher demonstrated a chain of logic flaws in Microsoft Edge that enabled arbitrary code execution outside the browser's sandbox without memory corruption. The vulnerabilities were patched by Microsoft the day after they were exploited at Pwn2Own Berlin.

A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown.

Orange Tsai of DEVCORE published the full method on October 28, five months after the chain won $175,000 at the Pwn2Own Berlin contest in May. Microsoft fixed the Edge bugs the day after the contest,

Read original article