Top 10 winner

Microsoft Edge (Chromium) - Elevation of Privilege to Potential RCE

Microsoft Edge (Chromium) - Elevation of Privilege to Potential Remote Code Execution

@qab · leucosite.com

Chromium Edge's new tab page is a remote MSN page holding privileged chrome APIs, and unsanitised top-site titles gave script execution inside it. Calling the undocumented chrome.qbox.navigate with a null url crashed the browser exploitably, and an XSS on an MSN subdomain set a cookie that poisoned the cached new tab page for persistent takeover.

Record

Document

Microsoft Edge (Chromium) - Elevation of Privilege to Potential Remote Code Execution

Researcher

@qab

Published by

leucosite.com

Topic

Browser

In the archive

• Ranked #9 in the 2019 Top 10 Web Hacking Techniques

Tags

• xss
• privilege-escalation
• rce
• cookie
• info-leak
• javascript
• attack-chain
• bug-bounty
• owasp-a01-2021
• owasp-a03-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of @qab, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.