Top 10 winner

How I Hacked Microsoft Teams and got $150,000 in Pwn2Own

@kinugawamasato and Masato Kinugawa · Speaker Deck · 31 July 2023

Three Microsoft Teams (Electron 1.x) bugs chained into zero-click remote code execution: a wildcard-allowed CSS class smuggles an AngularJS ng-init expression into a chat message for XSS, the main window's missing contextIsolation hands over a reference to ipcRenderer, and the unsandboxed PluginHost's unchecked remote-object property walk reaches Function() to run OS commands on the victim's machine.

Record

Researcher

@kinugawamasato and Masato Kinugawa

Published by

Speaker Deck

Date

31 July 2023

Format

Slides

Topic

Other

In the archive

• Ranked #7 in the 2023 Top 10 Web Hacking Techniques

Related sources

• Microsoft Teams Pwn2Own demonstration

Tags

• xss
• csti
• sanitizer-bypass
• sandbox-escape
• rce
• gadget-chain
• electron
• angular
• javascript
• attack-chain
• owasp-a03-2021
• owasp-a05-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of @kinugawamasato and Masato Kinugawa, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.