Forging a Microsoft Edge Full Chain with Logic Bugs Only
76 points by austinallegro 5 hours ago | 18 comments

darkamaul 2 hours ago
Orange is a legend and this chain is extremely impressive here.

No memory corruptions, no heap shenanigans, just pure logic bugs, almost made easy to understand for the reader.

As a bonus, they also posted a reverse chain: popping Edge from calc [0].

[0] https://www.youtube.com/watch?v=Bh1zglq4mLE

reply
its-summertime 3 hours ago
I always felt bad about the whole site/browser cross integration that chrome and edge and others do. Now I feel really really really bad about it. Can almost see the marketing team's emails about what features to add, and the developers unwantingly writing the code not expecting such things to open so many holes
reply
sharpshadow 56 minutes ago
The popup nightmare never stops.
reply
zhiyan 3 hours ago
human craft is becoming rare these days
reply
Geezus_42 2 hours ago
Has been for a long time.
reply
cubefox 32 minutes ago
It's more that LLMs increasingly outperform humans in finding vulnerabilities, so the share of human discoveries goes down.
reply
breakingcups 2 hours ago
This is amazing work.
reply
berofeev 2 hours ago
Excellent write up
reply
cyclopeanutopia 2 hours ago
Stopped at

> I won’t go into too much detail in this post, because I think in this era, you can just ask your agents to fill in the details :)

reply
russelg 58 minutes ago
If you can understand nuance and context, you would realise the phrase right before that is saying that he's not going to go into details about how navigation itself works in Chrome/Edge, and to watch the presentation from Google itself about those specific details if you are so inclined.

If you then continued on to read the remainder of the article, you would also discover that there was no AI assistance in this research at all.

reply
est 2 hours ago
It's your loss. The whole article is very good written.
reply
ncruces 8 minutes ago
And much better for not going into needless detail.

In fact, a problem with LLMs is that they consistently write more than I want to read.

reply
maeln 2 hours ago
The article does actually go pretty in detail about the exploit.
reply
MonkeyClub 2 hours ago
Same; either put in the work to think it through and show us your thought process and conclusions, or just post your prompts and call it a day and everyone gets to move on.
reply
russelg 57 minutes ago
If you continued to read the article, you would discover that he indeed goes through his entire thought process in building this chain. Including the fact this was done with no AI assistance at all.
reply
MonkeyClub 33 minutes ago
I stand corrected then, I’ll return to it!
reply
tsujamin 2 hours ago
Imagine missing such a great bug-chain because an off-hand AI comment at the start put you off
reply
cyclopeanutopia 8 minutes ago
No need to imagine it.
reply