{"slug": "patch-in-exploit-out-how-deepsec-reconstructed-the-pwn2own-microsoft-edge-escape", "title": "Patch In, Exploit Out: How deepsec Reconstructed the Pwn2Own Microsoft Edge Sandbox Escape", "summary": "On May 14, 2026, security researcher Orange Tsai won the browser category at Pwn2Own Berlin with a Microsoft Edge sandbox escape that chained four logic bugs, earning $175,000. Now, DARKNAVY's AI-powered security system deepsec has reconstructed the full exploit chain using only pre- and post-patch binaries and Microsoft advisories, identifying a path-traversal file-write primitive in Edge's feedback component as the final step.", "body_md": "On May 14, 2026, security researcher Orange Tsai demonstrated a Microsoft Edge sandbox escape at Pwn2Own Berlin, one of the world’s premier hacking competitions. He was the only contestant to win the browser category, earning $175,000. The organizers later revealed that his exploit chained together four logic bugs rather than relying on the memory-corruption vulnerabilities commonly used in browser exploitation. The news sparked intense discussion across the global security community, but the mechanics of the attack remained unknown.\n\nFor the next two months, technical details remained limited to the information in Microsoft’s security advisories, and no third party publicly reproduced the attack. **Now, for the first time, the PoC Agent in our AI-powered security system, deepsec, has reconstructed every step and produced a working reproduction of the exploit.**\n\n## The Limitations of Traditional Patch Analysis[#](#the-limitations-of-traditional-patch-analysis)\n\nAnalyzing security patches from vendors such as Microsoft and Apple is an important part of security programs within enterprises and critical infrastructure organizations. This work helps teams determine the real-world impact of vulnerabilities, assess how quickly attackers may weaponize them, independently verify whether patches fully address the underlying issues, and develop detection and mitigation capabilities.\n\nIn this case, however, the vulnerabilities were buried in the massive Edge codebase, with a single binary module exceeding 300 MB. Applying traditional binary diffing at this scale demands substantial expert effort. After loading the target module and its debugging symbols into a tool such as IDA, the resulting IDB can reach 5 GB, making analysis extremely time-consuming.\n\nMoreover, non-semantic changes introduced by compiler optimizations and function reordering generate large amounts of noise unrelated to the target vulnerabilities. In this Edge update, more than 32,000 functions differed between the vulnerable and patched versions, making the security-critical fixes even harder to isolate.\n\nUnlike memory-corruption vulnerabilities, logic bugs depend heavily on code context and application semantics. Examining changed functions in isolation is rarely enough to reconstruct their full security implications.\n\nOur subsequent review found that the logic bugs in this Edge exploit chain were spread across several unrelated modules, including navigation validation, asynchronous tab selection, and feedback-log processing. Even after locating an individual fix, it was difficult to determine what exploit primitive the underlying vulnerability provided, let alone how to chain it with the others.\n\nDuring our research, we found that AI significantly accelerated semantic analysis and the discovery of relationships across modules. Based on this insight, we implemented an automated differential analysis framework within deepsec, integrating binary diffing tools, the PoC Agent platform, and DARKNAVY’s security research knowledge base into a unified workflow.\n\nWe used this complex Edge exploit chain as a test case to determine whether deepsec could reconstruct the full chain using only the pre- and post-patch binaries and the limited information available from Microsoft.\n\n## Working Backward from the End: A Path-Traversal File-Write Primitive[#](#working-backward-from-the-end-a-path-traversal-file-write-primitive)\n\nFaced with an unknown exploit chain, deepsec began at the end, using the vulnerability advisories to identify the primitive with the clearest expected behavior.\n\ndeepsec first identified a clear security fix in Edge’s feedback component: file-writing functionality present in the vulnerable version had been removed from the patched version. Further analysis showed that the vulnerable interface contained a path-traversal flaw, providing the arbitrary file-write primitive needed at the end of the exploit chain. With additional exploitation techniques, this primitive could be turned into remote code execution on Windows.\n\ndeepsec also identified the precondition for triggering the vulnerable interface: the attacker needed to execute JavaScript on a privileged page that exposed the `edgeFeedbackPrivate`\n\nAPI.\n\nThe final portion of the exploit chain was now clear:\n\nJavaScript execution on a privileged page → Call the\n\n`edgeFeedbackPrivate`\n\nAPI → Write a file through path traversal → Windows RCE\n\nThe next question was how an attacker could reach this privileged execution environment from an ordinary web page.\n\n## Breaking Navigation Restrictions: Arbitrary URL Navigation[#](#breaking-navigation-restrictions-arbitrary-url-navigation)\n\nFollowing the advisory’s reference to “navigation handling,” deepsec performed targeted differential analysis of the relevant components. It located the CA Guidance navigation component and identified several security fixes, with the most important changes concentrated in `EdgeCAGuidanceNavigationThrottle::WillStartRequest`\n\n.\n\nThe vulnerable version used the `switch_profile`\n\nparameter directly as the navigation target, without restricting special schemes such as `javascript:`\n\n. The patched version introduced a URL-scheme allowlist.\n\nNavigation-source validation also changed. The vulnerable version called `GetVisibleURL`\n\nto retrieve the URL currently displayed in the tab and used it to determine whether the navigation originated from a Microsoft sign-in page. The patched version instead called `GetInitiatorOrigin`\n\nto validate the navigation’s actual initiator.\n\nAt first glance, this appeared to be a simple change in which URL source was used for validation. However, deepsec identified a subtle but important difference between the security implications of the two approaches: in the vulnerable version, an untrusted context could control navigation of the page whose URL was being validated.\n\nAn attacker could first navigate a tab under their control to a Microsoft sign-in page, then trigger the subsequent navigation from an untrusted context. This meant that the tab whose visible URL passed validation could differ from the context that initiated the navigation, allowing the attacker to bypass the source restriction.\n\nEven after bypassing source validation, however, the renderer process still could not navigate directly to `edge://guidance-ca-error`\n\n. The exploit chain therefore remained blocked at its entry point.\n\nFurther analysis by deepsec uncovered an unpatched validation gap that could be used to enter the same processing path: the component compared only the host of the entry URL and did not validate its scheme. An attacker could therefore use `https://guidance-ca-error/`\n\nto reach the same logic, bypassing the renderer’s restriction against direct navigation to the privileged `edge://`\n\nscheme. Once inside that flow, the attacker could set `switch_profile`\n\nto either a privileged page or a `javascript:`\n\nURL.\n\nMalicious page → CA Guidance navigation → Arbitrary URL navigation →\n\n`javascript:`\n\nURL or privileged page\n\ndeepsec now had an arbitrary URL-navigation primitive, but this was still not enough to complete the exploit.\n\n## The Final Piece: Achieving UXSS[#](#the-final-piece-achieving-uxss)\n\nThe vulnerabilities identified so far suggested the overall direction of the attack:\n\nNavigation-validation bypass → UXSS → Privileged API access → Path-traversal file write\n\nOne critical piece was still missing.\n\nThe attacker could initiate arbitrary navigation from a Microsoft sign-in page, execute code on the current page via a `javascript:`\n\nURL, or navigate to a privileged page. However, these capabilities could not be combined directly. After navigating to a privileged page exposing the `edgeFeedbackPrivate`\n\nAPI, the attacker still needed a way to execute JavaScript within that page’s context.\n\nFor a time, deepsec’s analysis reached an impasse.\n\ndeepsec also identified several suspicious fixes in other modules. For example, the vulnerable version of QuickAuth lacked necessary restrictions on navigation targets, while the patched version introduced a target allowlist and other security checks. As the number of candidates grew, determining the true exploit path became increasingly difficult.\n\nAt this point, deepsec had to prioritize candidates much like a human researcher: which fixes represented independent issues in adjacent attack surfaces, and which changes could provide the missing link in the current exploit chain?\n\nAfter exploring several directions in parallel, deepsec concluded that QuickAuth and the other candidates lacked the conditions required for exploitation. It therefore focused its subsequent analysis on the CA Guidance path.\n\nBy tracing the flow downstream from `HandleCAErrorPageGuidance`\n\n, deepsec found the most subtle flaw in the entire chain: an object-binding error.\n\nWhen the `email`\n\nparameter matched the current profile, `HandleCAErrorPageGuidance`\n\nused an asynchronous `PostTask`\n\nto navigate to the URL specified by `switch_profile`\n\n.\n\nIn the vulnerable version, the lambda captured a `WeakPtr<Browser>`\n\nreferring to the browser window. The navigation used the `CURRENT_TAB`\n\ndisposition but was not bound to a specific tab. At runtime, `Navigate`\n\ncalled `GetActiveWebContents`\n\nto retrieve the tab that was active at that moment and performed the navigation there.\n\nThe patched version instead captured a `WeakPtr<WebContents>`\n\nfor a specific tab, ensuring that the target URL was loaded in that same tab.\n\nAt first glance, this appeared to be an implementation detail with no obvious security significance. In the context of the exploit chain, however, deepsec recognized that the vulnerable implementation broke the binding between the object that passed the security check and the object on which the operation was ultimately performed.\n\nBecause the lambda executed asynchronously, the browser’s active tab could change between the time the task was posted and the time it ran. Consequently, the tab whose visible URL passed the Microsoft sign-in check and the tab in which JavaScript was ultimately executed did not have to be the same.\n\nAn attacker could construct a multi-stage navigation sequence: first, navigate one tab to the Microsoft sign-in page so that its visible URL would pass validation; then, before the asynchronous task executed, make the privileged target page the active tab.\n\nThis allowed the attacker to execute arbitrary JavaScript in the context of a privileged page exposing the `edgeFeedbackPrivate`\n\nAPI, completing the UXSS primitive.\n\nThe full exploit chain was now complete. First, the attacker initiated a CA Guidance navigation from a malicious page and exploited the entry URL’s host-only validation to reach the relevant processing path. Next, the attacker bypassed the flawed navigation-source validation and missing target-scheme restriction to obtain arbitrary URL navigation. Finally, the attacker exploited the object-binding error in the asynchronous navigation flow to switch the active tab and execute JavaScript on a privileged page exposing the `edgeFeedbackPrivate`\n\nAPI. From there, the attacker could call the vulnerable feedback interface, use path traversal to write an arbitrary file, and ultimately achieve remote code execution on Windows.\n\ndeepsec then developed and debugged a working exploit in a Windows virtual machine, validating the complete chain.\n\n## Conclusion[#](#conclusion)\n\nThis experiment demonstrates that deepsec can combine patch diffing, semantic analysis, browser security knowledge, and dynamic validation to reconstruct individual exploit primitives and determine how they fit together—even when public information is scarce, the target binaries are exceptionally large, and the vulnerabilities span unrelated components.\n\nThe release of a security patch by an upstream vendor such as Microsoft does not mean that every endpoint is immediately protected. Large enterprises often need to complete testing, deployment, and system restarts before an update can be fully rolled out, leaving an exposure window that may last for days or even months.\n\nIn the past, downstream organizations often took comfort in the assumption that attackers would struggle to reconstruct complex vulnerabilities quickly and that large-scale exploitation would remain prohibitively expensive.\n\nAs AI-driven security capabilities continue to mature, however, the time between patch release and successful weaponization will shrink dramatically.\n\n**Defenses built around that time gap may soon cease to be reliable.**", "url": "https://wpnews.pro/news/patch-in-exploit-out-how-deepsec-reconstructed-the-pwn2own-microsoft-edge-escape", "canonical_source": "http://www.darknavy.org/blog/patch_in_exploit_out_how_deepsec_reconstructed_the_pwn2own_microsoft_edge_sandbox_escape/", "published_at": "2026-08-01 15:35:20+00:00", "updated_at": "2026-08-01 19:23:42.360534+00:00", "lang": "en", "topics": ["ai-tools", "ai-research"], "entities": ["Orange Tsai", "Microsoft Edge", "Pwn2Own Berlin", "deepsec", "DARKNAVY", "Microsoft"], "alternates": {"html": "https://wpnews.pro/news/patch-in-exploit-out-how-deepsec-reconstructed-the-pwn2own-microsoft-edge-escape", "markdown": "https://wpnews.pro/news/patch-in-exploit-out-how-deepsec-reconstructed-the-pwn2own-microsoft-edge-escape.md", "text": "https://wpnews.pro/news/patch-in-exploit-out-how-deepsec-reconstructed-the-pwn2own-microsoft-edge-escape.txt", "jsonld": "https://wpnews.pro/news/patch-in-exploit-out-how-deepsec-reconstructed-the-pwn2own-microsoft-edge-escape.jsonld"}}