Orange Tsai's Pwn2Own Edge Chain Ends at a telnet Handler, and the Write-Up Names No CVE and No Patched Build

A web page that a victim opens in Microsoft Edge can end up running a 32-bit executable on the victim's PC, if the browser still contains the bugs that Orange Tsai of DEVCORE chained at Pwn2Own Berlin 2026. Tsai published the full chain on October 28 in a write-up that lists nine stages, no CVE identifiers for the Edge bugs and no patched version.

BleepingComputer reported on the contest's first day, May 14, that Tsai was awarded $175,000 "after chaining 4 logic bugs to achieve a sandbox escape on Microsoft Edge." Tsai's post says the chain uses five bugs and two Windows features. The post does not reconcile the two counts, and it does not say which stages are which.

The nine stages

Tsai wrote that the research took about two months, that the chain won an Epic Achievement Pwnie, and that Zero Day Initiative credited it with 17.5 Master of Pwn points. The post is also explicit that the logic flaws, not memory corruption, carry the weight.

Stage	What it abuses	Result
1	EdgeCAGuidanceNavigationThrottle checks the origin with GetLastCommittedURL()	A window.open() navigation slips past the origin check
2	Popup blocker whitelist allows about:blank#quickAuthPopup	Page navigates that popup to any site
3	OneAuth signs the user in on Microsoft sites	Profile exists without prior sign-in
4	CORS misconfiguration on assets.msn.com	Any site reads the signed-in user's email
5	Navigate() with no source_contents falls back to the active tab	Universal XSS on sites such as google.com
6	read:// scheme missing from the JavaScript-URL blocklist	UXSS reaches Immersive Reader's privileged WebUI
7	chrome.edgeFeedbackPrivate.zipDiagnosticLogFiles()	Arbitrary file write via path traversal and a NULL byte
8	Overwrite protocols.json in the AutoLaunchProtocolsComponent folder	telnet:// allowed from an attacker origin
9	telnet:// handler searches PATH for telnet.exe	A 32-bit PE dropped in a user-writable WindowsApps directory runs

Why the last step matters most

The final stage is the one that turns a browser flaw into a machine compromise. The telnet:// handler looks for telnet.exe on PATH, and a directory under WindowsApps that the user can write to sits on that PATH. Tsai dropped his own executable there.

The chain needs one interaction in his test: the UXSS in stage 5 depends on switching tabs during a delayed navigation. Tsai also notes that the edge://restart call after the config overwrite "isn't really necessary in a real attack, only for Pwn2Own," according to the write-up's account.

What the write-up leaves out

BleepingComputer's report states that vendors have 90 days to ship fixes after Pwn2Own before the Zero Day Initiative discloses, and says nothing about whether Microsoft has patched Edge. Counting 90 days from May 14 gives August 12, so the window had closed by the time Tsai published, but that is arithmetic and not a confirmation of a fix.

Tsai's post gives CVE-2026-58608 only for a separate Windows remote code execution bug he reported, not for the Edge chain. No Edge build number is named as the first to fix any stage. Readers who run Edge should confirm they are on the current stable channel build, since that is the only claim the sources support.

The gap is familiar. Brotli's decoder bug was fixed in February and disclosed in October, and Apple's git and curl still trust the eMudhra certificates. Here too, the facts needed to judge exposure sit in a conference payout, not in an advisory.

Tsai's post is dated October 28, 2026. Microsoft's security update guide is the place to look for the matching entries, and neither source cites one.