Researcher describes logic-bug chain that escaped Microsoft Edge’s sandbox

A researcher says a chain of browser logic flaws and Windows features enabled a no-click universal cross-site scripting attack and a path toward escaping Microsoft Edge’s sandbox. The account describes earning $175,000 at Pwn2Own Berlin 2026, but the supplied article text ends while discussing an arbitrary file-write flaw, so it does not establish the chain’s full technical outcome.

• The researcher says the chain used Edge navigation behavior to create a universal cross-site scripting primitive, then combined it with other weaknesses and features to trigger it without a click.· 1 source
• The account describes issues including a cross-window origin-check bypass, a popup whitelist, automatic sign-in, and a CORS misconfiguration that could expose a signed-in user’s email.· 1 source
• The researcher reports receiving $175,000 and 17.5 Master of Pwn points at Pwn2Own Berlin 2026; the supplied account cuts off during its description of an arbitrary file-write technique.· 1 source