Mantiqiy kamchiliklar zanjiri, xotira buzilishi bo'lmasa ham, zararli veb-sahifani Microsoft Edge sandboxidan tashqarida Windows kompyuterida ishlaydigan kodga aylantirishi mumkinligini xavfsizlik tadqiqotchisi ko'rsatdi.
DEVCORE'dan Orange Tsai to'liq usulni 28-oktabrda e'lon qildi, bu zanjir may oyida Pwn2Own Berlin tanlovida 175 000 dollar yutganidan besh oy o'tib. Microsoft Edge xatolarini tanlovdan bir kun keyin tuzatdi, shuning uchun yangilangan brauzer xavf ostida emas.
Brauzer sandboxi — bu veb-sahifa kodini brauzer ichida va kompyuterning qolgan qismidan tashqarida saqlaydigan devor. Undan qochish va keyin dastur ishga tushirish — bu veb-xatoni mashinaning to'liq nazoratiga aylantiradigan narsa.
Bunday brauzer qochishlari deyarli har doim xotira buzilishiga tayanadi. Bu esa hech qaysi biriga tayanmadi. O'z yozuvida Tsai zanjirni faqat Edge va Windows oddiy funksiyalarni qanday ishlatishidagi mantiqiy xatolardan qurilgan deb ta'riflaydi va butun eksploit 100 qator koddan kam ekanligini aytadi.
Natija universal cross-site scripting (UXSS) primitividir: har qanday veb-saytda JavaScript ishga tushirish usuli, bu uni oldini olish uchun mo'ljallangan content security policy'ni chetlab o'tadi.
Hujum brauzerning o'z jarayonidan boshlangani uchun, u oddiy veb-xato yetib bormaydigan google.com kabi saytlarga yetib borishi mumkin. Tsai buni bir martalik xato emas, balki yangi hujum yuzasi deb ataydi.
Bu tanlov eksploit edi, yovvoyi tabiatda ko'rilgan hujum emas. Tsai uni Pwn2Own'da sahnada namoyish etdi; haqiqiy foydalanuvchilarga qarshi ishlatilganiga dalil yo'q va ommaviy CVE yozuvlari eksploitatsiyani yo'q deb ro'yxatga olgan. Zanjirdagi bir qadam brauzerni qayta ishga tushiradi, Tsai buni tanlov uchun qulaylik deb ta'kidlaydi va haqiqiy hujumda kerak emas.
Zanjir biznes kirishlari uchun mo'ljallangan Edge funksiyasi — shartli kirish navigatsiya tezlatgichi bilan boshlanadi. Tsai uni ishga tushirish brauzerning o'z jarayoniga so'rov qilgan sahifaga bog'lanmagan yangi navigatsiyani boshlashga imkon berishini aniqladi, shuning uchun Edge uni ochiq bo'lgan har qanday yorliqqa biriktiradi. Bu mos kelmaslik birinchi xato va u UXSS hosil qiladi.
Uni bosmasdan ishlashini ta'minlash yana to'rtta zaiflikni talab qildi. Edge so'rov ishonchli Microsoft saytidan kelganini tekshirdi, lekin Tsai tekshiruvni ikkinchi oynadan so'rovni ochish orqali chetlab o'tdi. Edge'ning popup blokirovkasi bu oynani to'xtatishi kerak edi, lekin Edge ruxsat etilgan manzillar ro'yxatini qattiq kodlagan edi va ulardan biri popupni ochdi.
Hujum shuningdek, jabrlanuvchining allaqachon tizimga kirgan bo'lishini talab qildi, buni Edge avtomatik kirish funksiyasi foydalanuvchi Microsoft saytiga tashrif buyurganda o'z-o'zidan ta'minlaydi. Nihoyat, zanjir jabrlanuvchining elektron pochta manzilini Microsoft sayti assets.msn.com'dan o'qiydi, u noto'g'ri sozlangan cross-origin sozlamasi tufayli har qanday veb-saytga qaytarib berdi.
JavaScriptni hamma joyda ishga tushirish hali kompyuterni nazorat qilish emas. Sandboxdan qochish uchun Tsai Edge'ning o'qish rejimi Immersive Reader'dan foydalandi, u Microsoft skriptlar ishga tushirishdan taqiqlangan sahifalar ro'yxatiga kiritmagan maxsus read:// manzili ostida ishlaydi.
U yerdan zanjir diagnostika jurnallarini zip qilish uchun mo'ljallangan ichki Edge funksiyasini chaqirdi va uni diskning istalgan joyiga hujumchi tanlagan nom va mazmun bilan fayl yozish uchun suiiste'mol qildi.
Bu fayl yozish ikki qadamda kod ijrosiga aylantiriladi. Zanjir qaysi veb-saytlar qaysi protokol ishlovchilarini ishga tushirishi mumkinligini nazorat qiladigan konfiguratsiya faylini qayta yozadi, keyin fayl o'qilishi uchun Edge'ni qayta ishga tushiradi. Keyin u telnet:// havolasini ishga tushiradi; Windows sukut bo'yicha telnet dasturini o'rnatmagani uchun, u tizim yo'lidan birini qidiradi va past huquqli foydalanuvchi yozishi mumkin bo'lgan papkadan hujumchi joylashtirgan nusxani ishga tushiradi.
Microsoft tuzatishni 15-mayda, tanlovdan bir kun keyin, Edge Stable 148.0.3967.70 versiyasida jo'natdi. Bu reliz uchta Edge'ga xos tuzatishni o'z ichiga oldi, ular CVE-2026-45492, CVE-2026-45494 va CVE-2026-45495 sifatida kuzatiladi. Birinchisi xavfsizlik funksiyasi chetlab o'tishi, ikkinchisi esa aldash xatosi sifatida qayd etilgan, ikkalasi ham 148.0.3967.70'dan oldingi Edge versiyalariga ta'sir qiladi.
Microsoft yozuvlari birinchi ikkitasini 10 ballik shkalada 5.4 deb baholaydi, bu o'rta ball bo'lib, alohida xatoni aks ettiradi, ularni kod ijrosiga aylantiradigan to'liq zanjirni emas. DEVCORE tuzatish e'lon qilinganidan 24 soat ichida kelganini aytdi.
Edge'ni yangilash bu zanjirni yopadi. Taqdim may oyida jo'natilgani uchun, avtomatik yangilanishdagi brauzer uni allaqachon olgan va alohida harakat talab qilinmaydi.
Tsai zanjirni qo'lda, taxminan ikki oy davomida, hech qanday AI yordamisiz qurdi va bu ishni inson tadqiqoti hali ham muhim bo'lgan joy haqida fikr sifatida taqdim etadi. "Qiyin qismi ularni topish, va ularni barchasini topganingizdan so'ng, zanjirlash eng oson qismdir," deb yozadi u mantiqiy xatolar haqida. Tadqiqot 2026 Pwnie Award'da Epic Achievement mukofotini yutdi.
Ushbu maqolani qiziqarli deb topdingizmi? Bizni Google News, Twitter va LinkedIn'da kuzating, biz e'lon qiladigan eksklyuziv kontentni o'qish uchun.
A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown.
Orange Tsai of DEVCORE published the full method on October 28, five months after the chain won $175,000 at the Pwn2Own Berlin contest in May. Microsoft fixed the Edge bugs the day after the contest, so an up-to-date browser is not at risk.
A browser sandbox is the wall that keeps a web page's code inside the browser and off the rest of the computer. Breaking out of it, and then running a program, is what turns a web bug into full control of the machine.
Browser escapes like this almost always rely on memory corruption. This one used none. In his write-up, Tsai describes a chain built solely from logic errors in how Edge and Windows handle ordinary features, and he says the whole exploit is under 100 lines of code.
The result is a universal cross-site scripting (UXSS) primitive: a way to run JavaScript on any website, bypassing the content security policy meant to prevent it.
Because the attack starts from the browser's own process, it can reach sites like google.com that an ordinary web bug cannot touch. Tsai calls this a new attack surface rather than a one-off bug.
This was a competition exploit, not an attack seen in the wild. Tsai demonstrated it on stage at Pwn2Own; there is no evidence it has been used against real users, and the public CVE records list exploitation as none. One step in the chain restarts the browser, which Tsai notes is a convenience for the contest and not needed in a real attack.
The chain begins with an Edge feature for business sign-ins called a conditional access navigation throttle. Tsai found that triggering it lets the browser's own process start a new navigation that is not tied to the page that asked for it, so Edge attaches it to whichever tab is open. That mismatch is the first bug, and it produces the UXSS.
Making it run without a click took four more weaknesses. Edge checked that the request came from a trusted Microsoft site, but Tsai bypassed the check by opening the request from a second window. Edge's popup blocker should have stopped that window, but Edge carried a hardcoded list of allowed addresses, and one of them opened the popup.
Video 3
The attack also required the victim to be already signed in, which the Edge auto-sign-in feature provides on its own when the user visits a Microsoft site. Lastly, the chain reads the victim's email address from a Microsoft site, assets.msn.com, which returned it to any website due to a misconfigured cross-origin setting.
Running JavaScript everywhere is still not in control of the computer. To escape the sandbox, Tsai used Edge's reading mode, Immersive Reader, which runs under a custom read:// address that Microsoft left off the list of pages barred from running scripts.
From there, the chain called an internal Edge function meant to zip up diagnostic logs and abused it to write a file with an attacker-chosen name and content anywhere on disk.
That file write is turned into code execution in two steps. The chain overwrites a configuration file that controls which websites may launch which protocol handlers, then restarts Edge so the file is read. It then launches a telnet:// link; because Windows does not ship a telnet program by default, it searches the system path for one and runs an attacker-planted copy from a folder the low-privileged user can write to.
Microsoft shipped the fix on May 15, the day after the contest, in Edge Stable version 148.0.3967.70. That release carried three Edge-specific fixes, tracked as CVE-2026-45492, CVE-2026-45494, and CVE-2026-45495. The first is recorded as a security feature bypass, and the second as a spoofing bug, both affecting Edge versions before 148.0.3967.70.
Microsoft's records rate the first two at 5.4 on a 10-point scale, a medium score that reflects a single bug in isolation, not the full chain that strings them into code execution. DEVCORE said the fix came within 24 hours of the disclosure.
Updating Edge closes this chain. Because the fix shipped in May, a browser on automatic updates has long since received it, and no separate action is needed.
Tsai built the chain by hand, over about two months, without any AI help, and frames the work as a point about where human research still matters. "The hard part is finding them, and once you find them all, chaining is the easiest part," he writes of the logic bugs. The research won the 2026 Pwnie Award for Epic Achievement.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
