A security researcher demonstrated a chain of logic flaws in Microsoft Edge, winning $175,000 at the Pwn2Own Berlin contest in May. The flaws allowed a malicious web page to execute code outside the browser's sandbox.
The vulnerability or weakness
The attack relied on a chain of logic errors, with no memory corruption, to create a universal cross-site scripting (UXSS) primitive, allowing execution of JavaScript on any website.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Organizations may be at risk if they have outdated systems, though Microsoft patched the bugs immediately after the contest. The impact is minimal for up-to-date browsers.
Industries affected
This issue affects all industries that use Microsoft Edge, particularly those with a high reliance on web applications.
Users affected
Users of Microsoft Edge could be affected if they were using an outdated browser. However, since the issue was fixed shortly after the contest, current users are not at risk.
