A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown.
Orange Tsai of DEVCORE published the full method on October 28, five months after the chain won $175,000 at the Pwn2Own Berlin contest in May. Microsoft fixed the Edge bugs the day after the contest, so an up-to-date browser is not at risk.
A browser sandbox is the wall that keeps a web page's code inside the browser and off the rest of the computer. Breaking out of it, and then running a program, is what turns a web bug into full control of the machine.
Browser escapes like this almost always rely on memory corruption. This one used none. In his write-up, Tsai describes a chain built solely from logic errors in how Edge and Windows handle ordinary features, and he says the whole exploit is under 100 lines of code.
The result is a universal cross-site scripting (UXSS) primitive: a way to run JavaScript on any website, bypassing the content security policy meant to prevent it.
Because the attack starts from the browser's own process, it can reach sites like google.com that an ordinary web bug cannot touch. Tsai calls this a new attack surface rather than a one-off bug.
This was a competition exploit, not an attack seen in the wild. Tsai demonstrated it on stage at Pwn2Own; there is no evidence it has been used against real users, and the public CVE records list exploitation as none.
Source link
