tl;dr: Orange Tsai chained five logic bugs and two Windows features into a fully handcrafted, 0-click Microsoft Edge sandbox escape for Pwn2Own Berlin 2026, earning $175K and a Pwnie Award. The chain starts with an overlooked Navigation Throttle flaw (EdgeCAGuidanceNavigationThrottle) that yields a universal XSS bypassing CSP, bypasses origin/popup/sign-in/email-leak checks via a CORS misconfiguration and OneAuth auto sign-in, then abuses Immersive Reader's privileged read:// scheme to get arbitrary file write, overwriting protocols.json to auto-launch telnet:// and achieve code execution via PATH hijacking — all with zero memory corruption and no AI assistance.