Forging a Microsoft Edge Full Chain with Logic Bugs Only

# Summary Orange Tsai of DEVCORE Research Team demonstrated a complete Microsoft Edge sandbox escape exploit chain composed entirely of logic bugs—with no memory corruption vulnerabilities—that won $175,000 at Pwn2Own Berlin 2026. The exploit chains five bugs and two Windows features, exploiting an overlooked navigation throttle mechanism in Edge's enterprise Entra ID feature to manipulate browser process navigation and bypass security controls.