# Microsoft Edge (Chromium) - EoP via XSS to Potential RCE

Unsanitized top-site titles and a domainId cookie reflection gave XSS in Edge's privileged NTP, plus a chrome.qbox.navigate crash yielding potential RCE.

- Payout: $40,000
- Severity: high
- Program: Microsoft
- Credited: Abdulrahman Alqabandi
- Disclosed: 2019-12-24
- Write-up quality: 8/10
- Original: https://leucosite.com/Edge-Chromium-EoP-RCE/
- Library page: https://bugbountylibrary.com/r/blog%3Aleucosite-com-edge-chromium-eop-rce
- Tags: domain:browser impact:ato impact:rce kind:bounty platform:blog sev:high tech:chromium technique:chained technique:recon technique:source-review vuln:memory-corruption vuln:privilege-escalation vuln:xss

**Target:** Edge Chromium New Tab Page (ntp.msn.com) and chrome.qbox privileged API
**Root cause:** NTP top-site titles and the domainId cookie on the broken antp page were reflected into HTML without sanitization, and the privileged chrome.qbox.navigate function dereferenced attacker-controlled JSON fields unsafely.
**Steps:**
1. Visit any page with title `<iframe/src=1/ onload=...>` so it becomes an NTP top site; title renders unsanitized in privileged NTP context.
2. In privileged context call `chrome.qbox.navigate({id:999999,url:null})` to trigger an access violation in msedge!ChromeMain.
3. For persistent takeover: POST `startnum=90'<SvG/onLoAd=eval(...)>` to `http://technology.za.msn.com/pebble.asp?relid=172` inside hidden iframe to get XSS.
4. XSS sets cookie `domainId=q"*<payload>*"q;domain=.msn.com;path=/`.
5. Redirect victim to `https://ntp.msn.com/compass/antp?locale=qab&dsp=1&sp=qabzz` where domainId is reflected in a script tag.
6. Payload iterates localStorage `lastKnown*` keys, prepends `<SvG/OnLoAd='document.write(/@qab/.source)'>` to cached NTP HTML, persisting execution on every new tab.
**How found:** Noticed a stray bold 'a' on the NTP after visiting a page titled with HTML, realizing top-site titles were unsanitized; then enumerated the chrome object comparing normal vs edge://settings pages, found undocumented chrome.qbox, and fuzzed navigate's JSON args until a crash. Separately used ParamMiner to discover the domainId cookie reflection on the broken antp page.
**Exploitation:** Attacker hosts a page with a hidden iframe POSTing the XSS payload to technology.za.msn.com; on load it sets a .msn.com-scoped domainId cookie, then redirects to the broken NTP page where the cookie is reflected and executed, poisoning localStorage-cached NTP HTML for persistent privileged JS execution.
**Escalation:** Chained a low-priv subdomain XSS to cookie-scoped injection on a privileged NTP origin, then used privileged chrome.* APIs (authPrivate token acquisition, ntpSettingsPrivate, embeddedSearch) and separately reached a memory-corruption crash via chrome.qbox.navigate.
**Insight:** Compare the `chrome` JS object between normal web origins and privileged edge:// pages to find undocumented privileged APIs; and treat browser-internal online pages (ntp.msn.com) as web app targets where cookie reflections and localStorage-cached HTML can yield persistent privileged XSS.